diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 99009a4..d8fd7c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,15 +28,10 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y postgresql-client python3.11 python3.11-venv python3-pip
-
       - name: Install Python dependencies
         run: |
-          pip install --upgrade pip
-          pip install -e ".[dev]"
+          python3 -m pip install --upgrade pip
+          python3 -m pip install -e ".[dev]"
 
       - name: Run linters
         run: |
@@ -56,7 +51,7 @@ jobs:
           SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD || 'dummy' }}
           FROM_EMAIL: ${{ secrets.FROM_EMAIL || 'test@example.com' }}
         run: |
-          pytest tests/ -v --cov=src/pote --cov-report=term --cov-report=xml
+          python3 -m pytest tests/ -v --cov=src/pote --cov-report=term --cov-report=xml
 
       - name: Test scripts
         env:
@@ -75,19 +70,19 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python3.11 -m pip install --upgrade pip
-          python3.11 -m pip install safety bandit
+          python3 -m pip install --upgrade pip
+          python3 -m pip install safety bandit
 
       - name: Run safety check
         run: |
-          python3.11 -m pip install -e .
-          python3.11 -m safety check --json || true
+          python3 -m pip install -e .
+          python3 -m safety check --json || true
         continue-on-error: true
 
       - name: Run bandit security scan
         run: |
-          python3.11 -m bandit -r src/ -f json -o bandit-report.json || true
-          python3.11 -m bandit -r src/ -f screen
+          python3 -m bandit -r src/ -f json -o bandit-report.json || true
+          python3 -m bandit -r src/ -f screen
         continue-on-error: true
 
   dependency-scan:
@@ -111,20 +106,10 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: false
-          tags: pote:test
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Test Docker image
+      - name: Build and test Docker image
         run: |
+          # Plain docker build — buildx images are not visible to act_runner's docker run
+          docker build -t pote:test .
           docker run --rm pote:test python -c "import pote; print('POTE import successful')"
 
   workflow-summary: