diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index a6bcb1a1..47a3eec4 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -62,6 +62,15 @@ jobs:
     # 2026-04-10 ogt: B5 改用 docker run 本地啟動，移除 services: 宣告
     # Gitea act runner 的 services: container name 為空，導致 CI 失敗
     steps:
+      - name: Bootstrap Host Runner Tools
+        # 2026-05-05 Codex: awoooi-host maps to the long-lived act-runner
+        # container. After dirty reboots it may not contain node/curl/git, and
+        # actions/checkout@v4 fails before tests can start.
+        run: |
+          if command -v apk >/dev/null 2>&1; then
+            apk add --no-cache nodejs npm git curl bash openssh-client
+          fi
+
       - uses: actions/checkout@v4
 
       # 2026-03-31 ogt: 優化告警格式 - 提高可讀性
@@ -258,6 +267,14 @@ jobs:
     timeout-minutes: 60
     runs-on: awoooi-host
     steps:
+      - name: Bootstrap Host Runner Tools
+        # 2026-05-05 Codex: keep the host-mode runner self-healing before
+        # actions/checkout@v4 and Telegram failure notifications run.
+        run: |
+          if command -v apk >/dev/null 2>&1; then
+            apk add --no-cache nodejs npm git curl bash openssh-client
+          fi
+
       - uses: actions/checkout@v4
 
       - name: Get Commit Info
@@ -809,6 +826,14 @@ jobs:
     # install-deps can also kill the act-managed job container with RWLayer=nil.
     runs-on: awoooi-host
     steps:
+      - name: Bootstrap Host Runner Tools
+        # 2026-05-05 Codex: post-deploy also uses checkout and curl-based
+        # notifications, so it needs the same runner bootstrap as earlier jobs.
+        run: |
+          if command -v apk >/dev/null 2>&1; then
+            apk add --no-cache nodejs npm git curl bash openssh-client
+          fi
+
       - uses: actions/checkout@v4
 
       - name: Get Commit Info