diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index a1a834f6e..1c71d3664 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -26,7 +26,7 @@ concurrency:
 jobs:
   validate:
     name: Validate Code Quality And Tests
-    runs-on: [host, ci-check]
+    runs-on: host
     timeout-minutes: 10
 
     env:
@@ -164,7 +164,7 @@ jobs:
 
   unit-tests:
     name: Unit Tests
-    runs-on: [host, ci-check]
+    runs-on: host
     timeout-minutes: 8
 
     env:
@@ -282,7 +282,7 @@ jobs:
 
   integration-tests:
     name: Integration Tests
-    runs-on: [host, ci-check]
+    runs-on: host
     timeout-minutes: 20
     if: always()
     needs: validate
@@ -543,7 +543,7 @@ jobs:
 
   frontend-lint:
     name: Frontend Lint
-    runs-on: [host, ci-check]
+    runs-on: host
     timeout-minutes: 10
 
     steps:
@@ -653,7 +653,7 @@ jobs:
 
   build-staging-api:
     name: Build Staging API Image
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 20
     needs: [validate, frontend-lint]
 
@@ -725,6 +725,20 @@ jobs:
           echo "Cache mode: read-only"
         fi
 
+    - name: Setup buildx builder (docker-container driver)
+      shell: sh
+      run: |
+        set -eu
+        # 确保使用 docker-container driver 以支持 cache export 功能
+        if ! docker buildx inspect ci-builder > /dev/null 2>&1; then
+          docker buildx create --use --name ci-builder --driver docker-container
+          echo "Created ci-builder (docker-container driver)"
+        else
+          docker buildx use ci-builder
+          echo "Using existing ci-builder"
+        fi
+        docker buildx inspect --bootstrap
+
     - name: Build and push API image (buildx cache)
       shell: sh
       run: |
@@ -755,7 +769,7 @@ jobs:
 
   build-staging-worker:
     name: Build Staging Worker Image
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 20
     needs: [validate, frontend-lint]
 
@@ -827,6 +841,20 @@ jobs:
           echo "Cache mode: read-only"
         fi
 
+    - name: Setup buildx builder (docker-container driver)
+      shell: sh
+      run: |
+        set -eu
+        # 确保使用 docker-container driver 以支持 cache export 功能
+        if ! docker buildx inspect ci-builder > /dev/null 2>&1; then
+          docker buildx create --use --name ci-builder --driver docker-container
+          echo "Created ci-builder (docker-container driver)"
+        else
+          docker buildx use ci-builder
+          echo "Using existing ci-builder"
+        fi
+        docker buildx inspect --bootstrap
+
     - name: Build and push Worker image (buildx cache)
       shell: sh
       run: |
@@ -857,7 +885,7 @@ jobs:
 
   build-staging-web:
     name: Build Staging Web Image
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 20
     needs: [validate, frontend-lint]
 
@@ -944,6 +972,20 @@ jobs:
         test -f apps/web/dist/index.html
         echo "Frontend build complete: $(ls apps/web/dist/ | head -5)"
 
+    - name: Setup buildx builder (docker-container driver)
+      shell: sh
+      run: |
+        set -eu
+        # 确保使用 docker-container driver 以支持 cache export 功能
+        if ! docker buildx inspect ci-builder > /dev/null 2>&1; then
+          docker buildx create --use --name ci-builder --driver docker-container
+          echo "Created ci-builder (docker-container driver)"
+        else
+          docker buildx use ci-builder
+          echo "Using existing ci-builder"
+        fi
+        docker buildx inspect --bootstrap
+
     - name: Build and push Web image (buildx cache)
       shell: sh
       run: |
@@ -975,7 +1017,7 @@ jobs:
 
   deploy-staging:
     name: Deploy Staging (Watchtower auto-deploy)
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 15
     needs: [build-staging-api, build-staging-worker, build-staging-web]
 
@@ -1076,7 +1118,7 @@ jobs:
 
   staging-e2e:
     name: Staging E2E Tests
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 15
     if: github.ref_name == 'develop' || github.ref_name == 'main'
     needs: deploy-staging
@@ -1152,7 +1194,7 @@ jobs:
 
   staging-api-tests:
     name: Staging API Integration Tests
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 10
     if: github.ref_name == 'develop' || github.ref_name == 'main'
     needs: deploy-staging
@@ -1227,7 +1269,7 @@ jobs:
 
   build-production-api:
     name: Build Production API Image
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 20
     needs: [validate, frontend-lint]
 
@@ -1287,6 +1329,20 @@ jobs:
         printf '%s' "${REGISTRY_TOKEN}" | docker login git.xiaoxiajianji.com -u xiaoxia --password-stdin
         echo "Docker login successful"
 
+    - name: Setup buildx builder (docker-container driver)
+      shell: sh
+      run: |
+        set -eu
+        # 确保使用 docker-container driver 以支持 cache export 功能
+        if ! docker buildx inspect ci-builder > /dev/null 2>&1; then
+          docker buildx create --use --name ci-builder --driver docker-container
+          echo "Created ci-builder (docker-container driver)"
+        else
+          docker buildx use ci-builder
+          echo "Using existing ci-builder"
+        fi
+        docker buildx inspect --bootstrap
+
     - name: Build and push API image (buildx cache)
       shell: sh
       run: |
@@ -1310,7 +1366,7 @@ jobs:
 
   build-production-worker:
     name: Build Production Worker Image
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 20
     needs: [validate, frontend-lint]
 
@@ -1370,6 +1426,20 @@ jobs:
         printf '%s' "${REGISTRY_TOKEN}" | docker login git.xiaoxiajianji.com -u xiaoxia --password-stdin
         echo "Docker login successful"
 
+    - name: Setup buildx builder (docker-container driver)
+      shell: sh
+      run: |
+        set -eu
+        # 确保使用 docker-container driver 以支持 cache export 功能
+        if ! docker buildx inspect ci-builder > /dev/null 2>&1; then
+          docker buildx create --use --name ci-builder --driver docker-container
+          echo "Created ci-builder (docker-container driver)"
+        else
+          docker buildx use ci-builder
+          echo "Using existing ci-builder"
+        fi
+        docker buildx inspect --bootstrap
+
     - name: Build and push Worker image (buildx cache)
       shell: sh
       run: |
@@ -1393,7 +1463,7 @@ jobs:
 
   build-production-web:
     name: Build Production Web Image
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 20
     needs: [validate, frontend-lint]
 
@@ -1467,6 +1537,20 @@ jobs:
         test -f apps/web/dist/index.html
         echo "Frontend build complete"
 
+    - name: Setup buildx builder (docker-container driver)
+      shell: sh
+      run: |
+        set -eu
+        # 确保使用 docker-container driver 以支持 cache export 功能
+        if ! docker buildx inspect ci-builder > /dev/null 2>&1; then
+          docker buildx create --use --name ci-builder --driver docker-container
+          echo "Created ci-builder (docker-container driver)"
+        else
+          docker buildx use ci-builder
+          echo "Using existing ci-builder"
+        fi
+        docker buildx inspect --bootstrap
+
     - name: Build and push Web image (buildx cache)
       shell: sh
       run: |
@@ -1506,7 +1590,7 @@ jobs:
 
   deploy-production:
     name: Deploy Production
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 20
     if: startsWith(github.ref, 'refs/tags/v')
     needs: [build-production-api, build-production-worker, build-production-web]
@@ -1588,7 +1672,7 @@ jobs:
 
   production-e2e:
     name: Production Browser E2E
-    runs-on: [host, build-only]
+    runs-on: saas
     timeout-minutes: 15
     if: startsWith(github.ref, 'refs/tags/v')
     needs: deploy-production