diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index 5dd3f1b..d68577f 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -39,7 +39,7 @@ env:
 jobs:
   build:
     name: build-push
-    runs-on: self-hosted  # Gitea runner 默认标签（act_runner 注册时未指定 --labels 时）
+    runs-on: ubuntu-22.04  # Gitea runner 实际标签（hermes-runner）
     timeout-minutes: 30
 
     steps:
@@ -117,7 +117,7 @@ jobs:
   scan:
     name: vulnerability-scan
     needs: build
-    runs-on: self-hosted
+    runs-on: ubuntu-22.04
     timeout-minutes: 10
     continue-on-error: true  # 扫描失败不阻塞流程