diff --git a/.gitea/workflows/backend-quality-gate.yml b/.gitea/workflows/backend-quality-gate.yml
index 982bd361..796ae7bb 100644
--- a/.gitea/workflows/backend-quality-gate.yml
+++ b/.gitea/workflows/backend-quality-gate.yml
@@ -269,22 +269,32 @@ jobs:
             artifacts/staging-images/manifest.env "$GITEA_SHA" "$IMAGE_REPOSITORY" >/dev/null
 
       - name: Upload immutable staging image manifest
-        uses: ./.gitea/actions/upload-artifact
-        # act_runner 0.6.1 resolves local Node actions but does not export their
-        # `with` values as INPUT_* variables. Keep `with` for newer runners and
-        # provide the same variables explicitly for the current staging runner.
-        env:
-          INPUT_NAME: staging-image-manifest-${{ gitea.sha }}-${{ gitea.run_attempt }}
-          INPUT_PATH: artifacts/staging-images/manifest.env
-          'INPUT_IF-NO-FILES-FOUND': error
-          'INPUT_RETENTION-DAYS': '30'
-          'INPUT_COMPRESSION-LEVEL': '6'
-          INPUT_OVERWRITE: 'false'
-        with:
-          name: staging-image-manifest-${{ gitea.sha }}-${{ gitea.run_attempt }}
-          path: artifacts/staging-images/manifest.env
-          if-no-files-found: error
-          retention-days: 30
+        run: |
+          set -euo pipefail
+          test -n "${ACTIONS_RUNTIME_TOKEN:-}"
+          test -n "${ACTIONS_RESULTS_URL:-}"
+          test -n "${GITHUB_RUN_ID:-}"
+          test -n "${GITHUB_REPOSITORY:-}"
+          workdir="$(pwd -P)"
+          docker run --rm \
+            --user "$(id -u):$(id -g)" \
+            --volume "$workdir:$workdir" \
+            --workdir "$workdir" \
+            --env HOME=/tmp \
+            --env "INPUT_NAME=staging-image-manifest-$GITEA_SHA-$GITEA_RUN_ATTEMPT" \
+            --env INPUT_PATH=artifacts/staging-images/manifest.env \
+            --env 'INPUT_IF-NO-FILES-FOUND=error' \
+            --env 'INPUT_RETENTION-DAYS=30' \
+            --env 'INPUT_COMPRESSION-LEVEL=6' \
+            --env INPUT_OVERWRITE=false \
+            --env ACTIONS_RUNTIME_TOKEN \
+            --env ACTIONS_RESULTS_URL \
+            --env GITHUB_RUN_ID \
+            --env GITHUB_REPOSITORY \
+            --env "GITHUB_SHA=$GITEA_SHA" \
+            --env "GITHUB_WORKSPACE=$workdir" \
+            node:22-bookworm-slim \
+            node .gitea/actions/upload-artifact/dist/index.js
 
       - name: Logout ACR registry
         if: always()
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index 5133a5eb..b6098878 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -164,8 +164,8 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 2);
   assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 2);
   assert.equal((workflow.match(/cat > "\$tool_dir\/node" <<'EOF'/g) ?? []).length, 1);
-  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 1);
-  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 1);
+  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 2);
   assert.equal((workflow.match(/ln -s node "\$tool_dir\/npm"/g) ?? []).length, 1);
   assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 2);
   assert.match(workflow, /node:22-bookworm-slim "\$\{0##\*\/\}" "\$@"/);
@@ -209,14 +209,16 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /get\("os"\)=="linux"/);
   assert.match(workflow, /get\("architecture"\)=="amd64"/);
   assert.match(workflow, /node frontend\/scripts\/staging-image-manifest\.mjs/);
-  assert.match(workflow, /uses: \.\/\.gitea\/actions\/upload-artifact/);
-  assert.match(workflow, /INPUT_PATH: artifacts\/staging-images\/manifest\.env/);
-  assert.match(workflow, /['"]INPUT_IF-NO-FILES-FOUND['"]: error/);
-  assert.match(workflow, /INPUT_OVERWRITE: ['"]false['"]/);
+  assert.match(workflow, /node \.gitea\/actions\/upload-artifact\/dist\/index\.js/);
+  assert.match(workflow, /--env INPUT_PATH=artifacts\/staging-images\/manifest\.env/);
+  assert.match(workflow, /--env ['"]INPUT_IF-NO-FILES-FOUND=error['"]/);
+  assert.match(workflow, /--env ACTIONS_RUNTIME_TOKEN/);
+  assert.match(workflow, /--env ACTIONS_RESULTS_URL/);
+  assert.match(workflow, /--env ['"]GITHUB_WORKSPACE=\$workdir['"]/);
   assert.match(read(giteaUploadArtifactAction), /main: ['"]dist\/index\.js['"]/);
   assert.match(read(giteaUploadArtifactAction), /81f940d004763f986ba3582c007fd842dd5cb0d7/);
   assert.ok(existsSync(fileURLToPath(giteaUploadArtifactEntrypoint)));
-  assert.match(workflow, /name: staging-image-manifest-\$\{\{ gitea\.sha \}\}-\$\{\{ gitea\.run_attempt \}\}/);
+  assert.match(workflow, /INPUT_NAME=staging-image-manifest-\$GITEA_SHA-\$GITEA_RUN_ATTEMPT/);
   assertOrder(workflow, [
     "docker login",
     "Record immutable linux-amd64 image manifest",