diff --git a/scripts/build-builder-image.sh b/scripts/build-builder-image.sh
index 697b0089..9aeaf21a 100755
--- a/scripts/build-builder-image.sh
+++ b/scripts/build-builder-image.sh
@@ -26,10 +26,26 @@ echo "🏷️  Tagging for registry..."
 docker tag ${IMAGE_NAME}:${IMAGE_TAG} ${FULL_IMAGE_NAME}
 
 # Step 3: Login to registry (if not already logged in)
+#
+# `docker info | grep Username` only ever reports a Docker Hub session, so for a
+# private registry it never matched — meaning this branch fired on every push and
+# dropped into an interactive `docker login`, which hangs any non-interactive run
+# (a scripted release, or CI). Check the credential store for this specific
+# registry instead, and refuse rather than prompt when there is no TTY to
+# prompt on.
 echo "🔐 Checking registry authentication..."
-if ! docker info | grep -q "Username"; then
-    echo "Not authenticated to Docker. Logging in to ${REGISTRY_HOST}..."
-    docker login ${REGISTRY_HOST}
+DOCKER_CFG="${DOCKER_CONFIG:-$HOME/.docker}/config.json"
+if ! grep -q "\"${REGISTRY_HOST}\"" "$DOCKER_CFG" 2>/dev/null; then
+    if [ -t 0 ]; then
+        echo "Not authenticated to ${REGISTRY_HOST}. Logging in..."
+        docker login "${REGISTRY_HOST}"
+    else
+        echo "❌ Not authenticated to ${REGISTRY_HOST}, and stdin is not a TTY."
+        echo "   Run this first:  docker login ${REGISTRY_HOST}"
+        exit 1
+    fi
+else
+    echo "   Using stored credentials for ${REGISTRY_HOST}."
 fi
 
 # Step 4: Push to registry