diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 40ef588..9afddb4 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -29,13 +29,29 @@ jobs:
       - name: Build
         run: yarn build
 
+      # `apt-get install awscli` failed with "no installation candidate" — the
+      # package is only in Ubuntu's universe component, so whether it resolves
+      # depends entirely on which image the runner happens to use. Install the
+      # official v2 bundle instead: self-contained, no distro packaging, and
+      # identical across images. The banner exists so the log identifies the
+      # image, since the failures so far have all been image drift.
+      - name: Install AWS CLI
+        run: |
+          echo "runner image: $( . /etc/os-release 2>/dev/null; echo "${PRETTY_NAME:-unknown}") $(uname -m)"
+          if command -v aws >/dev/null 2>&1; then aws --version; exit 0; fi
+          apt-get update -qq
+          apt-get install -y -qq curl unzip >/dev/null
+          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/awscliv2.zip
+          unzip -q /tmp/awscliv2.zip -d /tmp
+          /tmp/aws/install --update
+          aws --version
+
       - name: Deploy to S3
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
         run: |
-          apt-get update -qq && apt-get install -y -qq awscli > /dev/null
           aws s3 sync _site/ s3://${{ vars.S3_BUCKET }} --delete
           # sync guesses text/markdown for .md, which Firefox downloads
           # instead of displaying; text/plain shows the raw text in the tab