diff --git a/.gitea/workflows/APP_NAME-build.yaml b/.gitea/workflows/APP_NAME-build.yaml
index 3c31004..10d213b 100644
--- a/.gitea/workflows/APP_NAME-build.yaml
+++ b/.gitea/workflows/APP_NAME-build.yaml
@@ -164,21 +164,32 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Instalar helm
+      - name: Asegurar helm disponible
+        # helm v3.14.4 viene pre-horneado en la imagen del runner
+        # (infrastructure/ci-system/Dockerfile, igual que kubectl/trivy) → este
+        # step es un no-op de verificación. Fallback para imágenes antiguas:
+        # descarga a un directorio ÚNICO por-run (`mktemp -d`) y lo añade al PATH;
+        # NUNCA escribe a rutas compartidas ($HOME/.local/bin ni /tmp/linux-$ARCH),
+        # que con executor=host se pisan entre jobs concurrentes del mismo runner
+        # (causa raíz del flake first-deploy: "helm: Text file busy" /
+        # "mv: can't rename", CI-SHARED-HOME-RACE, sesión CI 2026-06-16).
         run: |
+          if command -v helm >/dev/null 2>&1; then
+            echo "helm pre-horneado en la imagen: $(helm version --short)"
+            exit 0
+          fi
           HELM_VERSION=v3.14.4
           case "$(uname -m)" in
             x86_64)  ARCH=amd64 ;;
             aarch64) ARCH=arm64 ;;
             *) echo "Arquitectura no soportada: $(uname -m)"; exit 1 ;;
           esac
-          mkdir -p "${HOME}/.local/bin"
+          DEST="$(mktemp -d)"
           curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-${ARCH}.tar.gz" \
-            | tar -xz -C /tmp "linux-${ARCH}/helm"
-          mv "/tmp/linux-${ARCH}/helm" "${HOME}/.local/bin/helm"
-          chmod +x "${HOME}/.local/bin/helm"
-          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
-          "${HOME}/.local/bin/helm" version
+            | tar -xz -C "$DEST" "linux-${ARCH}/helm"
+          chmod +x "${DEST}/linux-${ARCH}/helm"
+          echo "${DEST}/linux-${ARCH}" >> "$GITHUB_PATH"
+          "${DEST}/linux-${ARCH}/helm" version
 
       - name: Decodificar kubeconfig del tenant
         env: