diff --git a/.gitea/actions/quickstack-oci/deploy.mjs b/.gitea/actions/quickstack-oci/deploy.mjs
index 55f9924..7679628 100644
--- a/.gitea/actions/quickstack-oci/deploy.mjs
+++ b/.gitea/actions/quickstack-oci/deploy.mjs
@@ -22,7 +22,7 @@ const APP_FIELDS = [
   "containerCommand", "containerArgs", "securityContextRunAsUser",
   "securityContextRunAsGroup", "securityContextFsGroup", "securityContextPrivileged",
   "gitUrl", "gitBranch", "gitUsername", "gitToken", "dockerfilePath", "replicas",
-  "envVars", "memoryReservation", "memoryLimit", "cpuReservation", "cpuLimit",
+  "envVars", "buildArgs", "memoryReservation", "memoryLimit", "cpuReservation", "cpuLimit",
   "webhookId", "useNetworkPolicy",
   "healthChechHttpGetPath", "healthCheckHttpScheme", "healthCheckHttpHeadersJson",
   "healthCheckHttpPort", "healthCheckPeriodSeconds", "healthCheckTimeoutSeconds",
diff --git a/.gitea/actions/quickstack-oci/deploy.test.mjs b/.gitea/actions/quickstack-oci/deploy.test.mjs
index 04b1ff3..052569f 100644
--- a/.gitea/actions/quickstack-oci/deploy.test.mjs
+++ b/.gitea/actions/quickstack-oci/deploy.test.mjs
@@ -42,7 +42,7 @@ function app(overrides = {}) {
     id: "app-one", name: "One", appType: "APP", projectId: "project-one",
     sourceType: "GIT", buildMethod: "DOCKERFILE", containerImageSource: null,
     containerRegistryUsername: null, containerRegistryPassword: null, dockerfilePath: "./Dockerfile",
-    replicas: 1, envVars: "SECRET=preserved\nENVIRONMENT=old", ingressNetworkPolicy: "[]",
+    replicas: 1, buildArgs: "EXISTING_BUILD_ARG=preserved", envVars: "SECRET=preserved\nENVIRONMENT=old", ingressNetworkPolicy: "[]",
     egressNetworkPolicy: "[]", useNetworkPolicy: false, healthCheckPeriodSeconds: 10,
     healthCheckTimeoutSeconds: 2, healthCheckFailureThreshold: 3, appDomains: [], appPorts: [],
     appNodePorts: [], appFileMounts: [], appVolumes: [], appBasicAuths: [], project: {},
@@ -290,6 +290,8 @@ test("application dependencies reject missing nodes and cycles", () => {
 test("preserves response-only fields and existing environment secrets safely", () => {
   const payload = toSavePayload(app());
   assert.equal(payload.createdAt, undefined);
+  assert.equal(payload.buildArgs, app().buildArgs);
+  assert.equal(toSavePayload(app({ buildArgs: "" })).buildArgs, "");
   assert.equal(mergeEnvironment(app().envVars, { ENVIRONMENT: "new" }), "SECRET=preserved\nENVIRONMENT=new");
   assert.deepEqual(parseEnvironment("SECRET=preserved\nAPP_DEPLOYMENT_ID=source\nENVIRONMENT=new\ninvalid line"), {
     SECRET: "preserved",
@@ -384,6 +386,7 @@ test("failed public verification restores and redeploys the previous source", as
     getApp: async () => current,
     saveApp: async (payload) => {
       assert.deepEqual(payload.appNetworkPolicy, original.appNetworkPolicy);
+      assert.equal(payload.buildArgs, original.buildArgs);
       assert.equal(Object.hasOwn(payload, "appPorts"), false);
       current = { ...current, ...payload };
     },