diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index fc4d3cc38..3853be0fd 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -24,53 +24,78 @@ jobs:
         git -c http.https://api.xiaoxiajianji.com/.extraheader="$auth_header" fetch --depth=1 origin "$GITHUB_SHA"
         git checkout --force FETCH_HEAD
 
+    - name: Prepare deploy tooling
+      run: |
+        apt-get update
+        apt-get install -y docker.io curl
+
     - name: Sync code to staging workspace
       shell: bash
       run: |
         set -euo pipefail
-        mkdir -p /var/lib/xiaoxia-saas-staging
-        rm -rf /var/lib/xiaoxia-saas-staging/repo
-        mkdir -p /var/lib/xiaoxia-saas-staging/repo
-        tar --exclude=.git -cf - . | tar -xf - -C /var/lib/xiaoxia-saas-staging/repo
+        docker run --rm \
+          -v /:/host \
+          -v "$PWD":/workspace-src \
+          alpine:3.20 \
+          sh -lc '
+            set -eu
+            mkdir -p /host/var/lib/xiaoxia-saas-staging
+            rm -rf /host/var/lib/xiaoxia-saas-staging/repo
+            mkdir -p /host/var/lib/xiaoxia-saas-staging/repo
+            cd /workspace-src
+            tar --exclude=.git -cf - . | tar -xf - -C /host/var/lib/xiaoxia-saas-staging/repo
+          '
 
     - name: Verify staging env file
       run: |
-        test -f /var/lib/xiaoxia-saas-staging/.env
+        docker run --rm -v /:/host alpine:3.20 test -f /host/var/lib/xiaoxia-saas-staging/.env
 
     - name: Prepare staging env
       run: |
-        cp /var/lib/xiaoxia-saas-staging/.env /var/lib/xiaoxia-saas-staging/repo/.env
+        docker run --rm -v /:/host alpine:3.20 sh -lc 'cp /host/var/lib/xiaoxia-saas-staging/.env /host/var/lib/xiaoxia-saas-staging/repo/.env'
 
     - name: Build staging images
       run: |
-        docker build \
-          -t xiaoxia-saas-api:${{ github.sha }} \
-          -t xiaoxia-saas-api:staging \
-          -f /var/lib/xiaoxia-saas-staging/repo/infra/docker/api.Dockerfile \
-          /var/lib/xiaoxia-saas-staging/repo
-        docker build \
-          -t xiaoxia-saas-worker:${{ github.sha }} \
-          -t xiaoxia-saas-worker:staging \
-          -f /var/lib/xiaoxia-saas-staging/repo/infra/docker/worker.Dockerfile \
-          /var/lib/xiaoxia-saas-staging/repo
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v /:/host \
+          docker:27-cli sh -lc '
+            docker build \
+              -t xiaoxia-saas-api:${{ github.sha }} \
+              -t xiaoxia-saas-api:staging \
+              -f /host/var/lib/xiaoxia-saas-staging/repo/infra/docker/api.Dockerfile \
+              /host/var/lib/xiaoxia-saas-staging/repo && \
+            docker build \
+              -t xiaoxia-saas-worker:${{ github.sha }} \
+              -t xiaoxia-saas-worker:staging \
+              -f /host/var/lib/xiaoxia-saas-staging/repo/infra/docker/worker.Dockerfile \
+              /host/var/lib/xiaoxia-saas-staging/repo
+          '
 
     - name: Deploy staging containers
       run: |
-        cd /var/lib/xiaoxia-saas-staging/repo/infra/docker
-        API_IMAGE=xiaoxia-saas-api:staging \
-        WORKER_IMAGE=xiaoxia-saas-worker:staging \
-        docker compose up -d postgres redis api worker
-        docker compose ps
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v /:/host \
+          -w /host/var/lib/xiaoxia-saas-staging/repo/infra/docker \
+          -e API_IMAGE=xiaoxia-saas-api:staging \
+          -e WORKER_IMAGE=xiaoxia-saas-worker:staging \
+          docker:27-cli sh -lc '
+            docker compose up -d postgres redis api worker && \
+            docker compose ps
+          '
 
     - name: Verify staging health
       run: |
-        for i in $(seq 1 30); do
-          if curl -fsS http://127.0.0.1:8000/api/v1/health; then
-            exit 0
-          fi
-          sleep 2
-        done
-        exit 1
+        docker run --rm --network host curlimages/curl:8.8.0 sh -lc '
+          for i in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:8000/api/v1/health; then
+              exit 0
+            fi
+            sleep 2
+          done
+          exit 1
+        '
 
   deploy-production:
     name: Deploy Production
@@ -89,52 +114,77 @@ jobs:
         git -c http.https://api.xiaoxiajianji.com/.extraheader="$auth_header" fetch --depth=1 origin "$GITHUB_SHA"
         git checkout --force FETCH_HEAD
 
+    - name: Prepare deploy tooling
+      run: |
+        apt-get update
+        apt-get install -y docker.io curl
+
     - name: Sync code to production workspace
       shell: bash
       run: |
         set -euo pipefail
-        mkdir -p /var/lib/xiaoxia-saas-production
-        rm -rf /var/lib/xiaoxia-saas-production/repo
-        mkdir -p /var/lib/xiaoxia-saas-production/repo
-        tar --exclude=.git -cf - . | tar -xf - -C /var/lib/xiaoxia-saas-production/repo
+        docker run --rm \
+          -v /:/host \
+          -v "$PWD":/workspace-src \
+          alpine:3.20 \
+          sh -lc '
+            set -eu
+            mkdir -p /host/var/lib/xiaoxia-saas-production
+            rm -rf /host/var/lib/xiaoxia-saas-production/repo
+            mkdir -p /host/var/lib/xiaoxia-saas-production/repo
+            cd /workspace-src
+            tar --exclude=.git -cf - . | tar -xf - -C /host/var/lib/xiaoxia-saas-production/repo
+          '
 
     - name: Verify production env file
       run: |
-        test -f /var/lib/xiaoxia-saas-production/.env
+        docker run --rm -v /:/host alpine:3.20 test -f /host/var/lib/xiaoxia-saas-production/.env
 
     - name: Prepare production env
       run: |
-        cp /var/lib/xiaoxia-saas-production/.env /var/lib/xiaoxia-saas-production/repo/.env
+        docker run --rm -v /:/host alpine:3.20 sh -lc 'cp /host/var/lib/xiaoxia-saas-production/.env /host/var/lib/xiaoxia-saas-production/repo/.env'
 
     - name: Build production images
       run: |
-        docker build \
-          -t xiaoxia-saas-api:${{ github.sha }} \
-          -t xiaoxia-saas-api:${{ github.ref_name }} \
-          -t xiaoxia-saas-api:latest \
-          -f /var/lib/xiaoxia-saas-production/repo/infra/docker/api.Dockerfile \
-          /var/lib/xiaoxia-saas-production/repo
-        docker build \
-          -t xiaoxia-saas-worker:${{ github.sha }} \
-          -t xiaoxia-saas-worker:${{ github.ref_name }} \
-          -t xiaoxia-saas-worker:latest \
-          -f /var/lib/xiaoxia-saas-production/repo/infra/docker/worker.Dockerfile \
-          /var/lib/xiaoxia-saas-production/repo
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v /:/host \
+          docker:27-cli sh -lc '
+            docker build \
+              -t xiaoxia-saas-api:${{ github.sha }} \
+              -t xiaoxia-saas-api:${{ github.ref_name }} \
+              -t xiaoxia-saas-api:latest \
+              -f /host/var/lib/xiaoxia-saas-production/repo/infra/docker/api.Dockerfile \
+              /host/var/lib/xiaoxia-saas-production/repo && \
+            docker build \
+              -t xiaoxia-saas-worker:${{ github.sha }} \
+              -t xiaoxia-saas-worker:${{ github.ref_name }} \
+              -t xiaoxia-saas-worker:latest \
+              -f /host/var/lib/xiaoxia-saas-production/repo/infra/docker/worker.Dockerfile \
+              /host/var/lib/xiaoxia-saas-production/repo
+          '
 
     - name: Deploy production containers
       run: |
-        cd /var/lib/xiaoxia-saas-production/repo/infra/docker
-        API_IMAGE=xiaoxia-saas-api:latest \
-        WORKER_IMAGE=xiaoxia-saas-worker:latest \
-        docker compose up -d postgres redis api worker
-        docker compose ps
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v /:/host \
+          -w /host/var/lib/xiaoxia-saas-production/repo/infra/docker \
+          -e API_IMAGE=xiaoxia-saas-api:latest \
+          -e WORKER_IMAGE=xiaoxia-saas-worker:latest \
+          docker:27-cli sh -lc '
+            docker compose up -d postgres redis api worker && \
+            docker compose ps
+          '
 
     - name: Verify production health
       run: |
-        for i in $(seq 1 30); do
-          if curl -fsS http://127.0.0.1:8000/api/v1/health; then
-            exit 0
-          fi
-          sleep 2
-        done
-        exit 1
+        docker run --rm --network host curlimages/curl:8.8.0 sh -lc '
+          for i in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:8000/api/v1/health; then
+              exit 0
+            fi
+            sleep 2
+          done
+          exit 1
+        '
diff --git a/.gitea/workflows/tests.yml b/.gitea/workflows/tests.yml
index 178f75a98..c28b527e6 100644
--- a/.gitea/workflows/tests.yml
+++ b/.gitea/workflows/tests.yml
@@ -22,15 +22,17 @@ jobs:
         git -c http.https://api.xiaoxiajianji.com/.extraheader="$auth_header" fetch --depth=1 origin "$GITHUB_SHA"
         git checkout --force FETCH_HEAD
 
-    - name: Show Python runtime
+    - name: Install Python tooling
       run: |
+        apt-get update
+        apt-get install -y python3-pip python3-venv
         python3 --version
         python3 -m pip --version
 
     - name: Install dependencies
       run: |
-        python3 -m pip install --upgrade pip
-        python3 -m pip install -r requirements.txt -r requirements-dev.txt
+        python3 -m pip install --break-system-packages --upgrade pip
+        python3 -m pip install --break-system-packages -r requirements.txt -r requirements-dev.txt
 
     - name: Run tests
       run: |
@@ -51,15 +53,17 @@ jobs:
         git -c http.https://api.xiaoxiajianji.com/.extraheader="$auth_header" fetch --depth=1 origin "$GITHUB_SHA"
         git checkout --force FETCH_HEAD
 
-    - name: Show Python runtime
+    - name: Install Python tooling
       run: |
+        apt-get update
+        apt-get install -y python3-pip python3-venv
         python3 --version
         python3 -m pip --version
 
     - name: Install linting tools
       run: |
-        python3 -m pip install --upgrade pip
-        python3 -m pip install -r requirements.txt -r requirements-dev.txt
+        python3 -m pip install --break-system-packages --upgrade pip
+        python3 -m pip install --break-system-packages -r requirements.txt -r requirements-dev.txt
 
     - name: Run Black (check only)
       run: |