diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 8f48cec..b9f8d29 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -1,11 +1,12 @@
 # Deploy: build → push → nomad job run, on every push to master.
 #
-# Runner requirements (verify on the Forgejo VPS):
-#   - job container gets the docker socket (runner config must allow
-#     valid_volumes for /var/run/docker.sock — see README §deploy notes), or
-#     switch `runs-on` to the host label and drop the container/socket bits;
-#   - Docker Hub reachable (nomad CLI is extracted from hashicorp/nomad:1.9 —
-#     releases.hashicorp.com is blocked from this network).
+# Runner requirements (Forgejo VPS, via the docker-compose stack there):
+#   - DinD daemon also listens on unix:///var/run/docker.sock (so the job's
+#     docker:28-cli container can reach it via -v /var/run/docker.sock);
+#   - runner config valid_volumes allows '**' (the job mounts that socket).
+# nomad CLI is NOT extracted into the job container — the binary is
+# glibc-dynamically-linked and won't exec in Alpine; instead the Deploy step
+# runs `nomad` inside the hashicorp/nomad:1.9 image (which has the loader).
 #
 # Repo secrets (Settings → Secrets):
 #   REGISTRY_TOKEN   forgejo token, write:package scope (docker login)
@@ -40,13 +41,6 @@ jobs:
           git fetch --depth 1 origin ${{ github.sha }}
           git checkout -q FETCH_HEAD
 
-      - name: Extract nomad CLI (official image; CDN is blocked here)
-        run: |
-          docker create --name nomad-extract hashicorp/nomad:1.9 >/dev/null
-          docker cp nomad-extract:/bin/nomad /usr/local/bin/nomad
-          docker rm nomad-extract >/dev/null
-          nomad version
-
       - name: Registry login
         run: |
           echo "${{ secrets.REGISTRY_TOKEN }}" | \
@@ -63,13 +57,20 @@ jobs:
           done
 
       - name: Deploy to Nomad
+        # Run the nomad CLI inside its own image — the binary is
+        # glibc-dynamically-linked (PT_INTERP = ld-linux-x86-64.so.2), so it
+        # won't exec in the Alpine-based docker:28-cli container. The image
+        # has the loader; mount the workspace so the job file + CA cert are
+        # visible at the same paths.
         run: |
-          mkdir -p /tmp/nomad-tls
-          echo "${{ secrets.NOMAD_CACERT }}" > /tmp/nomad-tls/ca.crt
-          export IMAGE_TAG="${{ github.sha }}"
-          export NOMAD_ADDR="https://${{ vars.NOMAD_ADDR_HOST }}:4646"
-          export NOMAD_CACERT=/tmp/nomad-tls/ca.crt
-          export NOMAD_TOKEN="${{ secrets.NOMAD_TOKEN }}"
-          nomad job run deploy/nomad/contract-check.nomad.hcl
-          # the CLI follows the deployment and exits non-zero if health
-          # checks fail — auto_revert then rolls the job back server-side.
+          mkdir -p .ci-tls
+          printf '%s\n' "${{ secrets.NOMAD_CACERT }}" > .ci-tls/ca.crt
+          docker run --rm \
+            -v "$PWD:$PWD" -w "$PWD" \
+            -e IMAGE_TAG="${{ github.sha }}" \
+            -e NOMAD_ADDR="https://${{ vars.NOMAD_ADDR_HOST }}:4646" \
+            -e NOMAD_CACERT="$PWD/.ci-tls/ca.crt" \
+            -e NOMAD_TOKEN="${{ secrets.NOMAD_TOKEN }}" \
+            --entrypoint /bin/nomad \
+            hashicorp/nomad:1.9 job run deploy/nomad/contract-check.nomad.hcl
+          rm -rf .ci-tls