diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index d5a5885..5dd3f1b 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -39,7 +39,7 @@ env:
 jobs:
   build:
     name: build-push
-    runs-on: ubuntu-latest  # Gitea runner 标签，按实际配置调整
+    runs-on: self-hosted  # Gitea runner 默认标签（act_runner 注册时未指定 --labels 时）
     timeout-minutes: 30
 
     steps:
@@ -117,7 +117,7 @@ jobs:
   scan:
     name: vulnerability-scan
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     timeout-minutes: 10
     continue-on-error: true  # 扫描失败不阻塞流程