diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index a4f7142..1242b57 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -7,11 +7,11 @@
 #   api + worker  -> slartibartfast.kosherinata.internal  (share one SQLite file)
 #   web (SPA)     -> oolon.kosherinata.internal           (nginx serves + proxies /v1)
 #
-# Runners (labels match the fleet's registered runners): Rust jobs run on `rust`
-# (cargo toolchain); node/deploy jobs run on `fedora-43` (node + rsync/ssh/curl).
-# The whole fleet is Fedora 43, so binaries are built native — no glibc skew, no musl
-# toolchain needed (deployment-gitea-actions.md §6: build on a runner no newer than the
-# oldest target).
+# Runners (see architecture gitea-runners.md): Rust build on `rust` (cargo toolchain);
+# SPA build on `fedora-43` (node + pnpm); deploy jobs on `infra` (the only general image
+# with an ssh client + rsync). The whole fleet is Fedora, so binaries are built native —
+# no glibc skew, no musl toolchain needed (deployment-gitea-actions.md §6: build on a
+# runner no newer than the oldest target).
 #
 # One-time host prep (gitea_ci user, sudoers, service account, dirs, cert, vhost) is done
 # by script/infra-setup.sh. Only secret required here: RSYNC_SSH_KEY (the runner's private
@@ -58,8 +58,9 @@ jobs:
       - uses: actions/checkout@v4
       - name: build SPA
         working-directory: web
+        # pnpm is preinstalled globally on the fedora runners (via npm i -g pnpm);
+        # Fedora's nodejs doesn't bundle corepack, so call pnpm directly.
         run: |
-          corepack enable
           pnpm install --frozen-lockfile
           pnpm build
       - uses: actions/upload-artifact@v3
@@ -69,7 +70,7 @@ jobs:
 
   deploy-api:
     needs: build-api
-    runs-on: fedora-43
+    runs-on: infra
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3
@@ -127,7 +128,7 @@ jobs:
 
   deploy-web:
     needs: build-web
-    runs-on: fedora-43
+    runs-on: infra
     steps:
       - uses: actions/download-artifact@v3
         with: