diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index da586e4..2e142e5 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -8,52 +8,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: node:24.13.0-bookworm
+      image: node:24.13-alpine3.22
 
     steps:
       - name: Checkout
         uses: https://gitea.nikitapozd.dev/actions/checkout@v6
 
-      - name: Force APT repos to HTTPS + debug
-        shell: bash
+      - name: Install tools (curl, jq)
         run: |
           set -euxo pipefail
-
-          echo "== sources before =="
-          (cat /etc/apt/sources.list || true)
-          (ls -la /etc/apt/sources.list.d || true)
-          (cat /etc/apt/sources.list.d/*.list 2>/dev/null || true)
-
-          # Replace http -> https
-          sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list || true
-          sed -i 's|http://security.debian.org|https://security.debian.org|g' /etc/apt/sources.list || true
-          sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/*.list 2>/dev/null || true
-          sed -i 's|http://security.debian.org|https://security.debian.org|g' /etc/apt/sources.list.d/*.list 2>/dev/null || true
-
-          echo "== sources after =="
-          (cat /etc/apt/sources.list || true)
-          (cat /etc/apt/sources.list.d/*.list 2>/dev/null || true)
-
-      - name: Install tools (curl, jq) with hard timeouts (HTTPS)
-        shell: bash
-        run: |
-          set -euxo pipefail
-
-          timeout 90s apt-get update \
-            -o Acquire::ForceIPv4=true \
-            -o Acquire::Retries=1 \
-            -o Acquire::https::Timeout=10
-
-          timeout 90s apt-get install -y --no-install-recommends ca-certificates curl jq \
-            -o Acquire::ForceIPv4=true \
-            -o Acquire::Retries=1 \
-            -o Acquire::https::Timeout=10
-
-      - name: Install tools (curl, jq) with timeout
-        run: |
-          set -eux
-          timeout 30s apt-get update
-          timeout 30s apt-get install -y curl jq
+          timeout 30s apk update \
+          timeout 30s apk add --no-cache curl jq
 
       - name: Get Keycloak access token from Gitea secrets
         env: