diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index 778de5f..520b87a 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -70,14 +70,15 @@ jobs:
       - name: Test document parser boundary
         working-directory: tools/summarizer
         run: |
-          # The Debian runner has pip but intentionally omits python3-venv.
-          # Install into the checkout so CI remains isolated without sudo or a
-          # mutable runner-global Python environment.
+          # The Debian runner omits pip and python3-venv. Use pip's official
+          # zipapp and install into the checkout so CI remains isolated without
+          # sudo or a mutable runner-global Python environment.
           rm -rf .python-ci
-          python3 -m pip install --target .python-ci --require-hashes \
+          curl -fsSLo /tmp/pip.pyz https://bootstrap.pypa.io/pip/pip.pyz
+          python3 /tmp/pip.pyz install --target .python-ci --require-hashes \
             --extra-index-url https://download.pytorch.org/whl/cpu \
             -r requirements-linux.lock
-          python3 -m pip install --target .python-ci pytest==8.3.5 httpx2==2.12.0
+          python3 /tmp/pip.pyz install --target .python-ci pytest==8.3.5 httpx2==2.12.0
           PYTHONPATH="$PWD/.python-ci" AI_SERVICE_SKIP_MODEL_LOAD=1 python3 -m pytest -q
 
       - name: Restore backend