diff --git a/scripts/build-push.sh b/scripts/build-push.sh
index ff0771b..72fcd4e 100755
--- a/scripts/build-push.sh
+++ b/scripts/build-push.sh
@@ -25,16 +25,21 @@ SHA="$(git rev-parse --short HEAD)"
 ALL_TARGETS=(base gateway mcp-deribit mcp-bybit mcp-hyperliquid mcp-alpaca mcp-macro mcp-sentiment)
 TARGETS=("${@:-${ALL_TARGETS[@]}}")
 
-if [ -z "${GITEA_PAT:-}" ]; then
-    echo "FATAL: env GITEA_PAT non settata (PAT scope write:package)."
-    exit 1
-fi
-
 command -v docker >/dev/null || { echo "FATAL: docker non installato"; exit 1; }
 docker buildx version >/dev/null || { echo "FATAL: docker buildx non disponibile"; exit 1; }
 
-echo "=== docker login $REGISTRY ==="
-echo "$GITEA_PAT" | docker login "$REGISTRY" -u "$GITEA_USER" --password-stdin
+# Login solo se non già autenticato sul registry. Per primo login fai:
+#   echo "<PAT>" | docker login $REGISTRY -u $GITEA_USER --password-stdin
+if grep -q "\"$REGISTRY\"" ~/.docker/config.json 2>/dev/null; then
+    echo "=== docker già loggato su $REGISTRY (skip login) ==="
+elif [ -n "${GITEA_PAT:-}" ]; then
+    echo "=== docker login $REGISTRY ==="
+    echo "$GITEA_PAT" | docker login "$REGISTRY" -u "$GITEA_USER" --password-stdin
+else
+    echo "FATAL: non autenticato su $REGISTRY e GITEA_PAT non settata."
+    echo "  Esegui una volta: docker login $REGISTRY -u $GITEA_USER"
+    exit 1
+fi
 
 build_one() {
     local name="$1"