diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index c92a151..4775226 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -55,6 +55,16 @@ jobs:
         with:
           node-version: '20'
 
+      # The Debian runner's system Python omits ensurepip/python3-venv. Use the
+      # self-contained Actions runtime so the parser test can create an isolated
+      # environment without mutating the runner or requiring sudo.
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: pip
+          cache-dependency-path: tools/summarizer/requirements-linux.lock
+
       - name: Test repository safety scripts
         # Standard-library only and plan-only: this validates the synthetic benchmark harness
         # without contacting Ollama, pulling a model, or requiring package installation.