diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 421d63385..702e5c3d5 100755
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -35,7 +35,9 @@ concurrency:
 jobs:
   validate:
     name: Validate Code Quality And Tests
-    runs-on: host
+    runs-on:
+      - ci-l1
+      - host
     timeout-minutes: 10
     env:
       DATABASE_URL: postgresql+psycopg://postgres:postgres@127.0.0.1:5432/xiaoxia_saas
@@ -129,6 +131,9 @@ jobs:
         bash -n scripts/init_production_env.sh
 
         '
+    - name: Start PostgreSQL for validate (isolated container)
+      shell: sh
+      run: "set -eu\nPG_CONTAINER=\"ci-pg-validate-${GITHUB_RUN_ID:-$$}\"\necho \"PG_CONTAINER=$PG_CONTAINER\" >> \"$GITHUB_ENV\"\ndocker rm -f \"$PG_CONTAINER\" 2>/dev/null || true\ndocker run -d --name \"$PG_CONTAINER\" \\\n  --shm-size=256m \\\n  -e POSTGRES_USER=postgres \\\n  -e POSTGRES_PASSWORD=postgres \\\n  -e POSTGRES_DB=xiaoxia_saas \\\n  -P \\\n  --health-cmd \"pg_isready -U postgres\" \\\n  --health-interval 3s \\\n  --health-timeout 3s \\\n  --health-retries 20 \\\n  postgres:16\nPG_PORT=$(docker port \"$PG_CONTAINER\" 5432/tcp | cut -d: -f2)\necho \"PostgreSQL port: $PG_PORT\"\necho \"DATABASE_URL=postgresql+psycopg://postgres:postgres@127.0.0.1:$PG_PORT/xiaoxia_saas\" >> \"$GITHUB_ENV\"\nfor i in $(seq 1 30); do\n  if docker inspect --format='{{.State.Health.Status}}' \"$PG_CONTAINER\" 2>/dev/null | grep -q healthy; then\n    echo \"PostgreSQL is ready on port $PG_PORT\"\n    break\n  fi\n  echo \"Waiting for PostgreSQL... ($i/30)\"\n  sleep 2\ndone\ndocker inspect --format='{{.State.Health.Status}}' \"$PG_CONTAINER\" | grep -q healthy\n"
     - name: Validate Alembic migrations
       shell: sh
       run: 'set -eu
@@ -147,6 +152,14 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ github.token }}
       run: "set -eu\npython3 scripts/check_migration_safety.py --allow-medium-risk --diff-against origin/develop\n"
+    - name: Cleanup PostgreSQL (validate)
+      if: always()
+      shell: sh
+      run: 'docker rm -f "${PG_CONTAINER:-ci-pg-validate}" 2>/dev/null || true
+
+        echo "PostgreSQL container cleaned up"
+
+        '
     - name: Job duration summary
       if: always()
       shell: sh
@@ -164,7 +177,9 @@ jobs:
         '
   unit-tests:
     name: Unit Tests
-    runs-on: host
+    runs-on:
+      - ci-l2
+      - host
     timeout-minutes: 8
     env:
       USE_IN_MEMORY_DB: 'true'
@@ -235,7 +250,9 @@ jobs:
         '
   integration-tests:
     name: Integration Tests
-    runs-on: host
+    runs-on:
+      - ci-l2
+      - host
     timeout-minutes: 30
     if: always()
     needs: validate
@@ -352,7 +369,9 @@ jobs:
         '
   frontend-lint:
     name: Frontend Lint
-    runs-on: host
+    runs-on:
+      - ci-l1
+      - host
     timeout-minutes: 10
     steps:
     - name: Checkout code