diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index e0db935..ec0957d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -3,8 +3,9 @@
 # DESC:  CI/CD for H100PowerManger
 #        - build/test on aarch64 (QEMU emulation of arm64 Ubuntu 20.04)
 #        - deploy the cross-built binary to the RK3588 board
-#        NOTE: self-contained (no external actions), runner host needs
-#              Docker + internet to pull images + privileged for QEMU.
+#        Self-contained (no external actions). The runner is an Alpine
+#        container with the host Docker socket mounted; we install the
+#        docker CLI at runtime.
 #=======================================================================
 
 name: build-test-deploy
@@ -17,7 +18,7 @@ on:
 
 env:
   CI_IMAGE: h100-power-manager-ci:arm64
-  GITEA_SERVER: ${{ vars.GITEA_SERVER_URL }}
+  GITEA_SERVER: https://gitea2.zhaojingkui.xyz
 
 jobs:
   ci:
@@ -29,37 +30,25 @@ jobs:
       - name: Checkout
         run: |
           set -euo pipefail
-          SERVER="${GITEA_SERVER:-https://gitea2.zhaojingkui.xyz}"
-          REPO_URL="${SERVER}/zjk/H100PowerManger.git"
           git init .
-          git remote add origin "https://zjk:${{ secrets.CI_TOKEN }}@$(echo "${REPO_URL}" | sed 's|^https://||')"
+          git remote add origin "https://zjk:${{ secrets.CI_TOKEN }}@gitea2.zhaojingkui.xyz/zjk/H100PowerManger.git"
           git fetch --depth 1 origin "$GITHUB_SHA"
           git checkout FETCH_HEAD
 
       #-------------------------------------------------------------------
-      # Diagnostic (temporary)
+      # Install runtime tooling inside the (Alpine) runner container
       #-------------------------------------------------------------------
-      - name: Diagnose environment
+      - name: Install tools
         run: |
-          echo "PATH=$PATH"
-          echo "--- docker/podman ---"
-          command -v docker || echo "no docker"
-          command -v podman || echo "no podman"
-          command -v nerdctl || echo "no nerdctl"
-          ls -l /var/run/docker.sock 2>/dev/null || echo "no docker.sock"
-          docker ps 2>&1 | head -5 || true
-          echo "--- qemu ---"
-          command -v qemu-aarch64 || echo "no qemu-aarch64"
-          command -v qemu-aarch64-static || echo "no qemu-aarch64-static"
-          ls /proc/sys/fs/binfmt_misc/ 2>/dev/null
-          echo "--- arch/os ---"
-          uname -a
-          cat /etc/os-release 2>/dev/null | head -3
-          echo "--- network ---"
-          curl -sI --max-time 10 https://registry-1.docker.io/v2/ 2>&1 | head -3 || echo "docker hub unreachable"
+          apk add --no-cache docker-cli rsync openssh-client
+
+      - name: Verify docker
+        run: |
+          docker version
+          docker info 2>&1 | grep -Ei 'Architecture|Server Version|Operating System|Storage Driver' || true
 
       #-------------------------------------------------------------------
-      # Register QEMU so arm64 binaries/images can run on the x86 runner
+      # Register QEMU so arm64 images can run on the x86 host daemon
       #-------------------------------------------------------------------
       - name: Register QEMU for arm64
         run: |
@@ -85,7 +74,7 @@ jobs:
       # Deploy the cross-built binary to the RK3588 board (push only)
       #-------------------------------------------------------------------
       - name: Deploy to board
-        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
+        if: vars.DEPLOY_ENABLED == 'true'
         env:
           DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
           DEPLOY_USER: ${{ vars.DEPLOY_USER }}