diff --git a/.gitea/workflows/APP_NAME-build.yaml b/.gitea/workflows/APP_NAME-build.yaml
index 41d64df..46761ed 100644
--- a/.gitea/workflows/APP_NAME-build.yaml
+++ b/.gitea/workflows/APP_NAME-build.yaml
@@ -21,15 +21,31 @@ jobs:
       enforce_rollback: false         # rollout lo gestiona el job helm-deploy abajo
 
   # Deploy al cluster del tenant — Helm upgrade --install con hook Alembic.
+  # El runner corre executor=host (ci-system: container.enabled=false, ADR-043):
+  # los steps se ejecutan directo sobre el pod runner, sin Docker daemon. Por eso
+  # NO se usa `container:` — kubectl ya viene en la imagen del runner; helm se
+  # instala en runtime (la NetworkPolicy de los runners permite egress 443).
   helm-deploy:
     needs: build
-    runs-on: [self-hosted, linux/amd64]
-    container: alpine/helm:3.14.4
+    runs-on: [self-hosted, buildkit]
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install kubectl
-        run: apk add --no-cache kubectl
+      - name: Instalar helm
+        run: |
+          HELM_VERSION=v3.14.4
+          case "$(uname -m)" in
+            x86_64)  ARCH=amd64 ;;
+            aarch64) ARCH=arm64 ;;
+            *) echo "Arquitectura no soportada: $(uname -m)"; exit 1 ;;
+          esac
+          mkdir -p "${HOME}/.local/bin"
+          curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-${ARCH}.tar.gz" \
+            | tar -xz -C /tmp "linux-${ARCH}/helm"
+          mv "/tmp/linux-${ARCH}/helm" "${HOME}/.local/bin/helm"
+          chmod +x "${HOME}/.local/bin/helm"
+          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
+          "${HOME}/.local/bin/helm" version
 
       - name: Decodificar kubeconfig del tenant
         env:
@@ -40,9 +56,9 @@ jobs:
             echo "tenant-manager debe provisionarlo al crear el repo."
             exit 1
           fi
-          mkdir -p /root/.kube
-          echo "$KUBECONFIG_B64" | base64 -d > /root/.kube/config
-          chmod 600 /root/.kube/config
+          mkdir -p "${HOME}/.kube"
+          echo "$KUBECONFIG_B64" | base64 -d > "${HOME}/.kube/config"
+          chmod 600 "${HOME}/.kube/config"
 
       - name: Helm upgrade --install
         env: