diff --git a/.gitea/workflows/build-deploy.yaml b/.gitea/workflows/build-deploy.yaml
index 8c75440..1fd9d2d 100644
--- a/.gitea/workflows/build-deploy.yaml
+++ b/.gitea/workflows/build-deploy.yaml
@@ -64,17 +64,24 @@ jobs:
                   - name: registry-pull-secret
                 initContainers:
                   - name: clone
-                    image: ${PULL_REGISTRY}/${PROJECT}/alpine:3
+                    # alpine/git ships git — no flaky apk install at build time
+                    image: ${PULL_REGISTRY}/proxy-dockerhub/alpine/git:2.43.0
                     command:
                       - sh
                       - -c
-                      - apk add --no-cache git && git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace
+                      - git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace
                     volumeMounts:
                       - name: ws
                         mountPath: /workspace
                 containers:
                   - name: kaniko
                     image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
+                    # Kaniko pulls base images (node:24-alpine) straight from
+                    # docker.io — needs the egress proxy. NO_PROXY keeps the
+                    # push to harbor-registry direct.
+                    envFrom:
+                      - secretRef:
+                          name: registry-egress-proxy
                     args:
                       - --dockerfile=/workspace/backend/Dockerfile
                       - --context=dir:///workspace/backend
@@ -97,7 +104,11 @@ jobs:
                           path: config.json
           ENDJOB
           echo "Waiting for backend build job: ${JOB_NAME}"
-          kubectl -n ${BUILD_NS} wait --for=condition=complete job/${JOB_NAME} --timeout=20m
+          if ! kubectl -n ${BUILD_NS} wait --for=condition=complete job/${JOB_NAME} --timeout=40m; then
+            echo "--- kaniko logs (tail) ---"
+            kubectl -n ${BUILD_NS} logs job/${JOB_NAME} -c kaniko --tail=100 || true
+            exit 1
+          fi
           echo "Backend build done"
 
       - name: Build frontend image (Kaniko Job)
@@ -120,17 +131,20 @@ jobs:
                   - name: registry-pull-secret
                 initContainers:
                   - name: clone
-                    image: ${PULL_REGISTRY}/${PROJECT}/alpine:3
+                    image: ${PULL_REGISTRY}/proxy-dockerhub/alpine/git:2.43.0
                     command:
                       - sh
                       - -c
-                      - apk add --no-cache git && git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace
+                      - git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace
                     volumeMounts:
                       - name: ws
                         mountPath: /workspace
                 containers:
                   - name: kaniko
                     image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
+                    envFrom:
+                      - secretRef:
+                          name: registry-egress-proxy
                     args:
                       - --dockerfile=/workspace/frontend/Dockerfile
                       - --context=dir:///workspace/frontend
@@ -154,7 +168,11 @@ jobs:
                           path: config.json
           ENDJOB
           echo "Waiting for frontend build job: ${JOB_NAME}"
-          kubectl -n ${BUILD_NS} wait --for=condition=complete job/${JOB_NAME} --timeout=20m
+          if ! kubectl -n ${BUILD_NS} wait --for=condition=complete job/${JOB_NAME} --timeout=40m; then
+            echo "--- kaniko logs (tail) ---"
+            kubectl -n ${BUILD_NS} logs job/${JOB_NAME} -c kaniko --tail=100 || true
+            exit 1
+          fi
           echo "Frontend build done"
 
       - name: Update GitOps repo and push
diff --git a/RUNBOOK-CICD.fa.md b/RUNBOOK-CICD.fa.md
index 212bcef..1b7534b 100644
--- a/RUNBOOK-CICD.fa.md
+++ b/RUNBOOK-CICD.fa.md
@@ -228,6 +228,7 @@ Secretهایی که هنوز دستی‌اند (خارج از چرخهٔ CI): `a
 |-------|-------|
 | Workflow اجرا نمی‌شود | `kubectl -n gitea logs deploy/gitea-act-runner` — ثبت Runner و لیبل `abrban-builder` |
 | Build fail — clone | معتبربودن Secret `CI_TOKEN` در تنظیمات ریپوی `cloud-host` |
+| Build fail — pull ایمیج پایه (403 از docker.io) | Kaniko ایمیج پایه (`node:24-alpine`) را مستقیم از docker.io می‌کشد و به پروکسی egress نیاز دارد؛ Secret `registry-egress-proxy` باید در ns `cloudhost-builds` باشد (در Job با `envFrom` ست می‌شود) |
 | Build fail — push به Harbor | `kubectl -n cloudhost-builds get secret kaniko-harbor-auth`؛ پسورد باید با `REGISTRY_CREDENTIAL_PASSWORD` هاربر یکی باشد |
 | کامیت values push نمی‌شود | دسترسی write کاربر `ci` روی `cloud-host-gitops` |
 | Argo sync نمی‌کند | `kubectl -n argocd get app abrban-platform`؛ هر دو repo credential (`gitea-repo-creds` و `gitea-gitops-repo-creds`) |
diff --git a/gitops/README.md b/gitops/README.md
index eb529e0..4657a97 100644
--- a/gitops/README.md
+++ b/gitops/README.md
@@ -52,8 +52,10 @@ for ns in argocd gitea cloudhost-builds; do
   kubectl -n cloudhost get secret registry-pull-secret -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
 done
 
-# پروکسی egress برای act-runner (دانلود kubectl در initContainer)
-kubectl -n cloudhost get secret registry-egress-proxy -o yaml | sed 's/namespace: cloudhost/namespace: gitea/' | kubectl apply -f -
+# پروکسی egress برای act-runner (دانلود kubectl) و Kaniko (pull ایمیج پایه از docker.io)
+for ns in gitea cloudhost-builds; do
+  kubectl -n cloudhost get secret registry-egress-proxy -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
+done
 
 # 5. git push سورس به Gitea (نه docker push)
 #    git remote add gitea https://git.abrban.com/abrban/cloud-host.git