diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 0e6e0a3..223d591 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -18,8 +18,8 @@ jobs:
       DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
       DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: https://gitea.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.14'
       - name: Install CI dependencies with index diagnostics and fallback
@@ -66,8 +66,8 @@ jobs:
       DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
       DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: https://gitea.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.14'
       - name: Install deploy tooling
diff --git a/docs/deployment/GITEA_CD.md b/docs/deployment/GITEA_CD.md
index 31f3e6f..3a809b0 100644
--- a/docs/deployment/GITEA_CD.md
+++ b/docs/deployment/GITEA_CD.md
@@ -12,11 +12,11 @@ The optional photos mount is read-only and has supplementary group access.
 Historical repository receipts mention `/volume2/docker/pigway-frame-flow/data`,
 `/volume2/docker/pigway-frame-flow/config`, `/volume1/photo`, port 18787, and
 container/project `pigway-frame-flow`. These are **confirmation candidates**, not
-script defaults. The deployment script accepts only explicitly configured paths
+script defaults. The deploy action accepts only explicitly configured paths
 that match the existing running container on the Runner's Docker daemon.
 It rejects different projects, ports, unknown mounts, host/custom networking,
-missing photos confirmation, or different user/restart policy. It does not
-create NAS host directories or migrate/adopt an unrelated container.
+missing photos confirmation, or different user/restart policy. The deploy action does not create NAS host directories or migrate/adopt an unrelated
+container. First-time directory creation is limited to the manual bootstrap below.
 
 CI uses `ffci-*` projects, per-run image tags and named volumes, no host ports.
 Its cleanup does not refer to any production resource. Production uses fixed
@@ -271,3 +271,14 @@ as an Actions artifact. First bootstrap has no prior healthy version to roll bac
 
 Docker tests are mocked locally. The first manual NAS Runner bootstrap, including
 real host mounts and restart, remains the required live acceptance.
+
+## Actions download transport
+
+Verify and deploy use explicitly addressed, commit-pinned actions from
+`https://gitea.com/actions/checkout` (v4) and
+`https://gitea.com/actions/setup-python` (v5). This avoids the Runner default
+GitHub action discovery transport, which failed with EOF/timeouts in runs 27/28.
+All validation steps are unchanged. Python toolcache misses may still require
+setup-python to download Python from its upstream release source; this change
+does not claim to eliminate every external download. Action commits should be
+reviewed and intentionally updated, not silently replaced by mutable mirror tags.