diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 456ceb3..5bcdbbc 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -36,14 +36,23 @@ jobs:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-${{ matrix.arch }}-cargo-${{ hashFiles('Cargo.lock') }}
 
-      - name: Install audio build deps (libpipewire + clang for native capture)
+      - name: Ensure audio build deps (libpipewire + clang for native capture)
         run: |
-          SUDO=""; command -v sudo >/dev/null && SUDO=sudo
           if command -v apt-get >/dev/null; then
+            # Ephemeral container runner: safe to install into it.
+            SUDO=""; command -v sudo >/dev/null && SUDO=sudo
             $SUDO apt-get update
             $SUDO apt-get install -y libpipewire-0.3-dev libspa-0.2-dev clang libclang-dev pkg-config
-          elif command -v pacman >/dev/null; then
-            $SUDO pacman -Sy --needed --noconfirm pipewire clang pkgconf
+          else
+            # Bare/host runner: never mutate it - require deps preinstalled.
+            missing=""
+            pkg-config --exists libpipewire-0.3 2>/dev/null || missing="$missing libpipewire(+dev headers)"
+            command -v clang >/dev/null || missing="$missing clang"
+            if [ -n "$missing" ]; then
+              echo "::error::bare runner missing build deps:$missing — install once on the host; CI does not modify bare runners"
+              exit 1
+            fi
+            echo "bare runner already has libpipewire + clang"
           fi
 
       - name: Build