diff --git a/.gitea/workflows/build-deploy.yaml b/.gitea/workflows/build-deploy.yaml
index 0cb5de0..137ebed 100644
--- a/.gitea/workflows/build-deploy.yaml
+++ b/.gitea/workflows/build-deploy.yaml
@@ -11,34 +11,41 @@ env:
   REGISTRY: harbor-registry.cloudhost.svc.cluster.local:5000
   PROJECT: abrban
   BUILD_NS: cloudhost-builds
+  GITEA_URL: http://gitea-http.gitea.svc.cluster.local:3000
 
 jobs:
   build-and-deploy:
     runs-on: abrban-builder
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        shell: sh
+        run: |
+          git clone --depth=1 --branch main "${GITEA_URL}/abrban/cloud-host.git" workspace
+          cd workspace
+          echo "Checked out $(git rev-parse --short HEAD)"
 
       - name: Set image tag
         shell: sh
         run: |
-          SHA="${GITHUB_SHA:-$(git rev-parse HEAD)}"
-          TAG="$(date +%Y%m%d-%H%M)-$(echo $SHA | cut -c1-8)"
+          cd workspace
+          SHA="$(git rev-parse --short HEAD)"
+          TAG="$(date +%Y%m%d-%H%M)-${SHA}"
           echo "IMAGE_TAG=${TAG}" >> "$GITHUB_ENV"
           echo "Build tag: ${TAG}"
 
       - name: Build backend image (Kaniko Job)
         shell: sh
         run: |
+          JOB_NAME="build-be-$(echo $IMAGE_TAG | tr '.:' '-' | cut -c1-50)"
           cat <<ENDJOB | kubectl apply -f -
           apiVersion: batch/v1
           kind: Job
           metadata:
-            name: build-backend-${IMAGE_TAG}
+            name: ${JOB_NAME}
             namespace: ${BUILD_NS}
           spec:
             ttlSecondsAfterFinished: 600
-            backoffLimit: 1
+            backoffLimit: 0
             template:
               spec:
                 restartPolicy: Never
@@ -46,16 +53,17 @@ jobs:
                   - name: registry-pull-secret
                 initContainers:
                   - name: clone
-                    image: ${REGISTRY}/${PROJECT}/act-runner:0.2.11
-                    command: ["sh", "-c", "git clone --depth=1 --branch main http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git /workspace"]
+                    image: ${REGISTRY}/${PROJECT}/alpine:3
+                    command:
+                      - sh
+                      - -c
+                      - apk add --no-cache git && git clone --depth=1 --branch main ${GITEA_URL}/abrban/cloud-host.git /workspace
                     volumeMounts:
                       - name: ws
                         mountPath: /workspace
                 containers:
                   - name: kaniko
                     image: ${REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
-                    command:
-                      - /kaniko/executor
                     args:
                       - --dockerfile=/workspace/backend/Dockerfile
                       - --context=dir:///workspace/backend
@@ -69,22 +77,23 @@ jobs:
                   - name: ws
                     emptyDir: {}
           ENDJOB
-          echo "Waiting for backend build..."
-          kubectl -n ${BUILD_NS} wait --for=condition=complete job/build-backend-${IMAGE_TAG} --timeout=20m
+          echo "Waiting for backend build job: ${JOB_NAME}"
+          kubectl -n ${BUILD_NS} wait --for=condition=complete job/${JOB_NAME} --timeout=20m
           echo "Backend build done"
 
       - name: Build frontend image (Kaniko Job)
         shell: sh
         run: |
+          JOB_NAME="build-fe-$(echo $IMAGE_TAG | tr '.:' '-' | cut -c1-50)"
           cat <<ENDJOB | kubectl apply -f -
           apiVersion: batch/v1
           kind: Job
           metadata:
-            name: build-frontend-${IMAGE_TAG}
+            name: ${JOB_NAME}
             namespace: ${BUILD_NS}
           spec:
             ttlSecondsAfterFinished: 600
-            backoffLimit: 1
+            backoffLimit: 0
             template:
               spec:
                 restartPolicy: Never
@@ -92,16 +101,17 @@ jobs:
                   - name: registry-pull-secret
                 initContainers:
                   - name: clone
-                    image: ${REGISTRY}/${PROJECT}/act-runner:0.2.11
-                    command: ["sh", "-c", "git clone --depth=1 --branch main http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git /workspace"]
+                    image: ${REGISTRY}/${PROJECT}/alpine:3
+                    command:
+                      - sh
+                      - -c
+                      - apk add --no-cache git && git clone --depth=1 --branch main ${GITEA_URL}/abrban/cloud-host.git /workspace
                     volumeMounts:
                       - name: ws
                         mountPath: /workspace
                 containers:
                   - name: kaniko
                     image: ${REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
-                    command:
-                      - /kaniko/executor
                     args:
                       - --dockerfile=/workspace/frontend/Dockerfile
                       - --context=dir:///workspace/frontend
@@ -116,20 +126,19 @@ jobs:
                   - name: ws
                     emptyDir: {}
           ENDJOB
-          echo "Waiting for frontend build..."
-          kubectl -n ${BUILD_NS} wait --for=condition=complete job/build-frontend-${IMAGE_TAG} --timeout=20m
+          echo "Waiting for frontend build job: ${JOB_NAME}"
+          kubectl -n ${BUILD_NS} wait --for=condition=complete job/${JOB_NAME} --timeout=20m
           echo "Frontend build done"
 
-      - name: Update GitOps values
+      - name: Update GitOps values and push
         shell: sh
         run: |
+          cd workspace
           sed -i "s|tag: \"[^\"]*\"|tag: \"${IMAGE_TAG}\"|g" gitops/platform/values-abrban.yaml
           git config user.email "ci@abrban.com"
           git config user.name "Gitea Actions"
           git add gitops/platform/values-abrban.yaml
-          git diff --cached --quiet || git commit -m "ci: deploy platform ${IMAGE_TAG}"
-
-      - name: Push GitOps update
-        shell: sh
-        run: |
-          git push origin HEAD:main
+          if ! git diff --cached --quiet; then
+            git commit -m "ci: deploy platform ${IMAGE_TAG}"
+            git push origin HEAD:main
+          fi