diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 3f445f771..324e65ec2 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -30,7 +30,7 @@ jobs:
         set -eu
         tar --exclude=.git -cf - . | docker run --rm -i \
           -v /:/host \
-          alpine:3.20 \
+          docker:27-cli \
           sh -lc '
             set -eu
             mkdir -p /host/var/lib/xiaoxia-saas-staging
@@ -43,38 +43,48 @@ jobs:
       shell: sh
       run: |
         set -eu
-        docker run --rm -v /:/host alpine:3.20 test -f /host/var/lib/xiaoxia-saas-staging/.env
+        docker run --rm -v /:/host docker:27-cli sh -lc 'test -f /host/var/lib/xiaoxia-saas-staging/.env'
 
     - name: Prepare staging env
       shell: sh
       run: |
         set -eu
-        docker run --rm -v /:/host alpine:3.20 sh -lc 'cp /host/var/lib/xiaoxia-saas-staging/.env /host/var/lib/xiaoxia-saas-staging/repo/.env'
+        docker run --rm -v /:/host docker:27-cli sh -lc 'cp /host/var/lib/xiaoxia-saas-staging/.env /host/var/lib/xiaoxia-saas-staging/repo/.env'
 
     - name: Build staging images
       shell: sh
       run: |
         set -eu
-        docker build \
-          -t xiaoxia-saas-api:${GITHUB_SHA} \
-          -t xiaoxia-saas-api:staging \
-          -f /var/lib/xiaoxia-saas-staging/repo/infra/docker/api.Dockerfile \
-          /var/lib/xiaoxia-saas-staging/repo
-        docker build \
-          -t xiaoxia-saas-worker:${GITHUB_SHA} \
-          -t xiaoxia-saas-worker:staging \
-          -f /var/lib/xiaoxia-saas-staging/repo/infra/docker/worker.Dockerfile \
-          /var/lib/xiaoxia-saas-staging/repo
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v /:/host \
+          docker:27-cli sh -lc '
+            docker build \
+              -t xiaoxia-saas-api:${GITHUB_SHA} \
+              -t xiaoxia-saas-api:staging \
+              -f /host/var/lib/xiaoxia-saas-staging/repo/infra/docker/api.Dockerfile \
+              /host/var/lib/xiaoxia-saas-staging/repo && \
+            docker build \
+              -t xiaoxia-saas-worker:${GITHUB_SHA} \
+              -t xiaoxia-saas-worker:staging \
+              -f /host/var/lib/xiaoxia-saas-staging/repo/infra/docker/worker.Dockerfile \
+              /host/var/lib/xiaoxia-saas-staging/repo
+          '
 
     - name: Deploy staging containers
       shell: sh
       run: |
         set -eu
-        cd /var/lib/xiaoxia-saas-staging/repo/infra/docker
-        API_IMAGE=xiaoxia-saas-api:staging \
-        WORKER_IMAGE=xiaoxia-saas-worker:staging \
-        docker compose up -d postgres redis api worker
-        docker compose ps
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v /:/host \
+          -w /host/var/lib/xiaoxia-saas-staging/repo/infra/docker \
+          -e API_IMAGE=xiaoxia-saas-api:staging \
+          -e WORKER_IMAGE=xiaoxia-saas-worker:staging \
+          docker:27-cli sh -lc '
+            docker compose up -d postgres redis api worker && \
+            docker compose ps
+          '
 
     - name: Verify staging health
       shell: sh
@@ -113,7 +123,7 @@ jobs:
         set -eu
         tar --exclude=.git -cf - . | docker run --rm -i \
           -v /:/host \
-          alpine:3.20 \
+          docker:27-cli \
           sh -lc '
             set -eu
             mkdir -p /host/var/lib/xiaoxia-saas-production
@@ -126,40 +136,50 @@ jobs:
       shell: sh
       run: |
         set -eu
-        docker run --rm -v /:/host alpine:3.20 test -f /host/var/lib/xiaoxia-saas-production/.env
+        docker run --rm -v /:/host docker:27-cli sh -lc 'test -f /host/var/lib/xiaoxia-saas-production/.env'
 
     - name: Prepare production env
       shell: sh
       run: |
         set -eu
-        docker run --rm -v /:/host alpine:3.20 sh -lc 'cp /host/var/lib/xiaoxia-saas-production/.env /host/var/lib/xiaoxia-saas-production/repo/.env'
+        docker run --rm -v /:/host docker:27-cli sh -lc 'cp /host/var/lib/xiaoxia-saas-production/.env /host/var/lib/xiaoxia-saas-production/repo/.env'
 
     - name: Build production images
       shell: sh
       run: |
         set -eu
-        docker build \
-          -t xiaoxia-saas-api:${GITHUB_SHA} \
-          -t xiaoxia-saas-api:${GITHUB_REF_NAME} \
-          -t xiaoxia-saas-api:latest \
-          -f /var/lib/xiaoxia-saas-production/repo/infra/docker/api.Dockerfile \
-          /var/lib/xiaoxia-saas-production/repo
-        docker build \
-          -t xiaoxia-saas-worker:${GITHUB_SHA} \
-          -t xiaoxia-saas-worker:${GITHUB_REF_NAME} \
-          -t xiaoxia-saas-worker:latest \
-          -f /var/lib/xiaoxia-saas-production/repo/infra/docker/worker.Dockerfile \
-          /var/lib/xiaoxia-saas-production/repo
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v /:/host \
+          docker:27-cli sh -lc '
+            docker build \
+              -t xiaoxia-saas-api:${GITHUB_SHA} \
+              -t xiaoxia-saas-api:${GITHUB_REF_NAME} \
+              -t xiaoxia-saas-api:latest \
+              -f /host/var/lib/xiaoxia-saas-production/repo/infra/docker/api.Dockerfile \
+              /host/var/lib/xiaoxia-saas-production/repo && \
+            docker build \
+              -t xiaoxia-saas-worker:${GITHUB_SHA} \
+              -t xiaoxia-saas-worker:${GITHUB_REF_NAME} \
+              -t xiaoxia-saas-worker:latest \
+              -f /host/var/lib/xiaoxia-saas-production/repo/infra/docker/worker.Dockerfile \
+              /host/var/lib/xiaoxia-saas-production/repo
+          '
 
     - name: Deploy production containers
       shell: sh
       run: |
         set -eu
-        cd /var/lib/xiaoxia-saas-production/repo/infra/docker
-        API_IMAGE=xiaoxia-saas-api:latest \
-        WORKER_IMAGE=xiaoxia-saas-worker:latest \
-        docker compose up -d postgres redis api worker
-        docker compose ps
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v /:/host \
+          -w /host/var/lib/xiaoxia-saas-production/repo/infra/docker \
+          -e API_IMAGE=xiaoxia-saas-api:latest \
+          -e WORKER_IMAGE=xiaoxia-saas-worker:latest \
+          docker:27-cli sh -lc '
+            docker compose up -d postgres redis api worker && \
+            docker compose ps
+          '
 
     - name: Verify production health
       shell: sh