diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 66649fc..594d416 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -36,6 +36,14 @@ jobs:
       - name: Build app
         run: npm run build
 
+      - name: Install Docker if missing
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            curl -fsSL https://get.docker.com | sh
+          fi
+          docker --version
+          docker compose version
+
       - name: Validate compose file
         run: docker compose config
 
@@ -49,6 +57,27 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      - name: Install and start Docker if missing
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            curl -fsSL https://get.docker.com | sh
+          fi
+
+          if ! docker info >/dev/null 2>&1; then
+            if command -v service >/dev/null 2>&1; then
+              service docker start || true
+            fi
+
+            if ! docker info >/dev/null 2>&1; then
+              nohup dockerd >/tmp/dockerd.log 2>&1 &
+            fi
+
+            timeout 60 sh -c 'until docker info >/dev/null 2>&1; do sleep 2; done'
+          fi
+
+          docker --version
+          docker compose version
+
       - name: Log in to Gitea registry
         run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
diff --git a/README.md b/README.md
index f263f23..395a1e4 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,8 @@ Required repository or organization secrets:
 - `REGISTRY_USERNAME`: Gitea username allowed to publish packages
 - `REGISTRY_TOKEN`: Gitea personal access token with package read/write access
 
+The workflow installs Docker if it is missing. If your Gitea runner is itself containerized, it still needs either privileged mode for Docker-in-Docker or a mounted host Docker socket.
+
 On pushes to `main`, CI publishes:
 
 ```bash