diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index f50aeeb..dc44862 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -59,20 +59,28 @@ jobs:
           done
 
       - name: Deploy to Nomad
-        # Run the nomad CLI inside its own image — the binary is
-        # glibc-dynamically-linked (PT_INTERP = ld-linux-x86-64.so.2), so it
-        # won't exec in the Alpine-based docker:28-cli container. The image
-        # has the loader; mount the workspace so the job file + CA cert are
-        # visible at the same paths.
+        # nomad runs inside its own image (glibc-dynamically-linked binary
+        # won't exec in Alpine-based docker:28-cli). Files reach the nomad
+        # container via `docker cp` (tar stream) — NOT bind mounts, because
+        # the workspace lives in the job container's overlay, not on the DinD
+        # daemon's host filesystem (bind sources resolve daemon-side).
         run: |
           mkdir -p .ci-tls
           printf '%s\n' "${{ secrets.NOMAD_CACERT }}" > .ci-tls/ca.crt
-          docker run --rm \
-            -v "$PWD:$PWD" -w "$PWD" \
+
+          docker create --name nomad-deploy \
             -e IMAGE_TAG="${{ github.sha }}" \
             -e NOMAD_ADDR="https://${{ vars.NOMAD_ADDR_HOST }}:4646" \
-            -e NOMAD_CACERT="$PWD/.ci-tls/ca.crt" \
+            -e NOMAD_CACERT=/tmp/ca.crt \
             -e NOMAD_TOKEN="${{ secrets.NOMAD_TOKEN }}" \
             --entrypoint /bin/nomad \
-            hashicorp/nomad:1.9 job run deploy/nomad/contract-check.nomad.hcl
+            hashicorp/nomad:1.9 job run /tmp/job.hcl
+
+          docker cp .ci-tls/ca.crt                       nomad-deploy:/tmp/ca.crt
+          docker cp deploy/nomad/contract-check.nomad.hcl nomad-deploy:/tmp/job.hcl
+
+          docker start -a nomad-deploy
+          rc=$?
+          docker rm nomad-deploy >/dev/null
           rm -rf .ci-tls
+          exit $rc