diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index b055040..a241e96 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -75,14 +75,25 @@ jobs:
         run: |
           set -euo pipefail
 
-          # k3s dind-rootless runner: use rootless Docker Unix socket.
-          export DOCKER_HOST="${DOCKER_HOST}"
+          # k3s dind-rootless runner: job containers do not have the runner's
+          # Unix socket. Prefer the exposed dind TCP API when available, while
+          # keeping the Unix socket as a fallback for host-style execution.
           unset DOCKER_TLS_VERIFY DOCKER_CERT_PATH DOCKER_CONTEXT
 
           # Avoid proxy pollution in the container/rootless Docker path; proxy envs
           # can break image pulls through the slirp4netns namespace.
           unset HTTP_PROXY HTTPS_PROXY ALL_PROXY http_proxy https_proxy all_proxy
 
+          if docker -H unix:///run/user/1000/docker.sock version >/dev/null 2>&1; then
+            export DOCKER_HOST="unix:///run/user/1000/docker.sock"
+          elif docker -H tcp://127.0.0.1:2375 version >/dev/null 2>&1; then
+            export DOCKER_HOST="tcp://127.0.0.1:2375"
+          else
+            DOCKER_HOST_IP="$(ip route | awk '/default/ {print $3; exit}')"
+            export DOCKER_HOST="tcp://${DOCKER_HOST_IP}:2375"
+            docker version
+          fi
+
           if [ -z "${REGISTRY_TOKEN:-}" ]; then
             echo "REGISTRY_TOKEN secret is required" >&2
             exit 1