diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 217a448..93818a1 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -49,7 +49,7 @@ jobs:
           pip install bandit pip-audit ruff --break-system-packages
 
       - name: Ruff lint
-        run: ruff check .
+        run: python3 -m ruff check . --isolated
 
       - name: Bandit (advisory)
         run: bandit -r . -q || true
@@ -61,7 +61,8 @@ jobs:
         run: |
           if [ -d tests ] || ls test_*.py *_test.py 2>/dev/null; then
             pip install pytest --break-system-packages
-            PYTHONPATH=. pytest -q
+            export PYTHONPATH=.
+            python3 -m pytest -q
           else
             echo "No tests found — skip"
           fi
diff --git a/scripts/ci-python.sh b/scripts/ci-python.sh
new file mode 100755
index 0000000..7cc174f
--- /dev/null
+++ b/scripts/ci-python.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Local / Gitea python-ci lane (ruff + pytest hard gates).
+set -euo pipefail
+
+export PYTHONPATH=.
+
+python3 -m ruff check . --isolated
+python3 -m pytest -q