diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7870dc9..f6ae53b 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -84,17 +84,27 @@ jobs:
       - name: Sync files and restart EMS
         run: |
           IMAGE=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/ems:${{ gitea.sha }}
+          SHA=${{ gitea.sha }}
+          REPO_URL=http://x:${{ secrets.MY_GITEA_CI_TOKEN }}@192.168.0.234:8765/${{ gitea.repository }}.git
 
+          # The helper container mounts /opt/ems from the HOST (absolute path — works).
+          # It clones/updates the repo there so relative paths in docker-compose.yml
+          # (./infra/traefik/...) resolve correctly when Docker Compose runs.
           docker run --rm \
             -v /var/run/docker.sock:/var/run/docker.sock \
             -v ${{ env.DEPLOY_DIR }}:${{ env.DEPLOY_DIR }} \
-            -v "$(pwd)":/src:ro \
             -e EMS_IMAGE=${IMAGE} \
             docker:cli sh -c "
               set -e
-              mkdir -p ${{ env.DEPLOY_DIR }}
-              cp /src/docker-compose.yml ${{ env.DEPLOY_DIR }}/
-              cp -r /src/infra ${{ env.DEPLOY_DIR }}/
+              apk add -q git
+
+              if [ -d ${{ env.DEPLOY_DIR }}/.git ]; then
+                git -C ${{ env.DEPLOY_DIR }} fetch --quiet
+              else
+                git clone --quiet ${REPO_URL} ${{ env.DEPLOY_DIR }}
+              fi
+              git -C ${{ env.DEPLOY_DIR }} checkout --quiet ${SHA}
+
               cd ${{ env.DEPLOY_DIR }}
               docker compose pull ems
               docker compose up -d ems