diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 02efd503b..7dd8e5499 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -26,7 +26,7 @@ concurrency:
 jobs:
   validate:
     name: Validate Code Quality And Tests
-    runs-on: host
+    runs-on: [host, ci-check]
     timeout-minutes: 10
 
     env:
@@ -164,7 +164,7 @@ jobs:
 
   unit-tests:
     name: Unit Tests
-    runs-on: host
+    runs-on: [host, ci-check]
     timeout-minutes: 8
 
     env:
@@ -282,7 +282,7 @@ jobs:
 
   integration-tests:
     name: Integration Tests
-    runs-on: host
+    runs-on: [host, ci-check]
     timeout-minutes: 20
     if: always()
     needs: validate
@@ -543,7 +543,7 @@ jobs:
 
   frontend-lint:
     name: Frontend Lint
-    runs-on: host
+    runs-on: [host, ci-check]
     timeout-minutes: 10
 
     steps:
@@ -653,7 +653,7 @@ jobs:
 
   deploy-staging:
     name: Build & Push Staging (Watchtower auto-deploy)
-    runs-on: saas
+    runs-on: [host, build-only]
     timeout-minutes: 30
     needs: [validate, frontend-lint]
 
@@ -802,7 +802,7 @@ jobs:
 
   staging-e2e:
     name: Staging E2E Tests
-    runs-on: saas
+    runs-on: [host, build-only]
     timeout-minutes: 15
     if: github.ref_name == 'develop' || github.ref_name == 'main'
     needs: deploy-staging
@@ -878,7 +878,7 @@ jobs:
 
   staging-api-tests:
     name: Staging API Integration Tests
-    runs-on: saas
+    runs-on: [host, build-only]
     timeout-minutes: 10
     if: github.ref_name == 'develop' || github.ref_name == 'main'
     needs: deploy-staging
@@ -953,7 +953,7 @@ jobs:
 
   build-production-runtime-images:
     name: Build Production Runtime Images
-    runs-on: saas
+    runs-on: [host, build-only]
     timeout-minutes: 30
     needs: [validate, frontend-lint]
 
@@ -1041,58 +1041,12 @@ jobs:
 
   deploy-production:
     name: Deploy Production
-    runs-on: saas
+    runs-on: [host, build-only]
     timeout-minutes: 20
     if: startsWith(github.ref, 'refs/tags/v')
     needs: build-production-runtime-images
 
     steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        python3 - <<'PY'
-        import io, os, tarfile, time, urllib.request, urllib.error
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
     - name: Install SSH client
       shell: sh
       run: |
@@ -1127,16 +1081,10 @@ jobs:
           key_path="$HOME/.ssh/xiaoxia_runtime_builder"
           echo "Using key: $key_path (home key)"
         elif [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/production_deploy_key"
+          key_path="$HOME/.ssh/id_ed25519"
           printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
           chmod 600 "$key_path"
           echo "Using key from PRODUCTION_SSH_KEY secret"
-        elif [ -f "$HOME/.ssh/id_ed25519" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-          echo "Using key: $key_path (default id_ed25519)"
-        elif [ -f /root/.ssh/id_ed25519 ]; then
-          key_path="/root/.ssh/id_ed25519"
-          echo "Using key: $key_path (root id_ed25519)"
         else
           echo "ERROR: No SSH key available"
           ls -la ~/.ssh/ 2>/dev/null || true
@@ -1175,7 +1123,7 @@ jobs:
 
   production-e2e:
     name: Production Browser E2E
-    runs-on: saas
+    runs-on: [host, build-only]
     timeout-minutes: 15
     if: startsWith(github.ref, 'refs/tags/v')
     needs: deploy-production