diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 9bc2882..49d2acf 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -20,7 +20,24 @@ jobs:
   build-deploy:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      # Manual checkout thay vì `uses: actions/checkout@v4` — tránh phụ thuộc
+      # github.com (act_runner mỗi run đều `git fetch` để check update action,
+      # khi VPS → github.com TCP timeout 21s thì toàn job fail trước khi tới
+      # test gate). Gitea internal network luôn ổn định, nên clone trực tiếp.
+      # Token `${{ github.token }}` (Gitea cũng dùng tên này) tự sẵn cho job.
+      - name: Checkout (manual git, bypass github.com)
+        shell: powershell
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q
+          git remote add origin "https://gitea-actions:${{ github.token }}@git.baocaogiaoduc.vn/${{ github.repository }}.git"
+          # Fetch ref (branch) thay vì SHA — không cần Gitea allow SHA fetch.
+          # Depth 30 đủ buffer nếu main đã commit thêm sau khi job pickup.
+          $ref = "${{ github.ref }}"
+          if ($ref -like "refs/heads/*") { $ref = $ref.Substring(11) }
+          git fetch --depth=30 origin $ref
+          git checkout --quiet "${{ github.sha }}"
+          git log -1 --oneline
 
       - name: Show tool versions
         shell: powershell
@@ -51,14 +68,18 @@ jobs:
             --results-directory test-results
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
-      - name: Upload test results
+      # Upload test results — bỏ vì `actions/upload-artifact@v4` cũng phụ thuộc
+      # github.com fetch (cùng vấn đề như actions/checkout). TRX file vẫn save
+      # local trong workspace `test-results/` cho debug khi cần.
+      - name: List test results (local debug)
         if: always()
-        continue-on-error: true   # nếu Gitea runner chưa có upload-artifact action, skip không block deploy
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-results
-          path: test-results/*.trx
-          retention-days: 14
+        shell: powershell
+        run: |
+          if (Test-Path test-results) {
+            Get-ChildItem test-results -Recurse | Format-Table FullName, Length
+          } else {
+            Write-Host "No test-results directory."
+          }
 
       # ============== BUILD ==============
       - name: Build backend