diff --git a/.gitea/workflows/backend-quality-gate.yml b/.gitea/workflows/backend-quality-gate.yml
index 176739c0..4452cbb2 100644
--- a/.gitea/workflows/backend-quality-gate.yml
+++ b/.gitea/workflows/backend-quality-gate.yml
@@ -50,11 +50,20 @@ jobs:
       - name: Install and verify Linux runner toolchain
         run: |
           set -euo pipefail
+          packages=()
           if ! docker compose version --short 2>/dev/null | grep -Eq '^v?2\.'; then
+            packages+=(docker-compose-v2)
+          fi
+          venv_probe="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-venv-probe.XXXXXX")"
+          if ! python3 -m venv "$venv_probe/venv" >/dev/null 2>&1; then
+            packages+=(python3-venv)
+          fi
+          rm -rf "$venv_probe"
+          if [ "${#packages[@]}" -gt 0 ]; then
             apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 \
               -o Acquire::https::Timeout=30 update
             DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-              docker-compose-v2
+              "${packages[@]}"
           fi
           python3 --version
           curl --version
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index c88cc2f8..72eef370 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -132,7 +132,10 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /python3 -m venv \.venv/);
   assert.match(workflow, /python -m playwright install --with-deps chromium/);
   assert.equal((workflow.match(/Acquire::https::Timeout=30 update/g) ?? []).length, 1);
-  assert.match(workflow, /apt-get install -y --no-install-recommends[\s\S]*docker-compose-v2/);
+  assert.match(workflow, /packages\+=\(docker-compose-v2\)/);
+  assert.match(workflow, /python3 -m venv "\$venv_probe\/venv"/);
+  assert.match(workflow, /packages\+=\(python3-venv\)/);
+  assert.match(workflow, /apt-get install -y --no-install-recommends[\s\S]*"\$\{packages\[@\]\}"/);
   assert.doesNotMatch(workflow, /packages\+=\((?:nodejs|npm)\)|apt-get install[^\n]*(?:nodejs|npm)/);
   assert.equal((workflow.match(/NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c/g) ?? []).length, 2);
   assert.equal((workflow.match(/NODE_TOOL_IMAGE: node:22-bookworm-slim/g) ?? []).length, 2);