diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a570d17..d864566 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,8 @@ env:
   # Cargo refuses to even parse. Keep this in step with the toolchain
   # pinned in apps/daemon/Dockerfile.
   RUST_TOOLCHAIN: "1.97"
+  # Static client only; the daemon comes from the socket the runner mounts.
+  DOCKER_CLI_VERSION: "29.7.1"
 
 jobs:
   # --- Lint + TypeScript Check ---
@@ -97,6 +99,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # The runner executes jobs inside a container that has no docker CLI,
+      # while act_runner mounts the host's socket at /var/run/docker.sock.
+      # Install just the client when it is missing, then prove the socket is
+      # actually reachable — the two failure modes look nothing alike and the
+      # message should say which one happened.
+      - name: Ensure docker CLI
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            url="https://download.docker.com/linux/static/stable/$(uname -m)/docker-${DOCKER_CLI_VERSION}.tgz"
+            if command -v curl >/dev/null 2>&1; then curl -fsSL "$url" -o /tmp/docker.tgz
+            else wget -qO /tmp/docker.tgz "$url"; fi
+            tar -xzf /tmp/docker.tgz -C /usr/local/bin --strip-components=1 docker/docker
+          fi
+          docker --version
+          docker version >/dev/null 2>&1 || {
+            echo "The docker socket is not reachable from this job."
+            echo "act_runner must mount it: leave container.docker_host empty in its config.yaml."
+            exit 1
+          }
+
       - name: Build API image
         run: docker build -f apps/api/Dockerfile -t gamepanel-api:ci .
 
@@ -127,6 +149,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # The runner executes jobs inside a container that has no docker CLI,
+      # while act_runner mounts the host's socket at /var/run/docker.sock.
+      # Install just the client when it is missing, then prove the socket is
+      # actually reachable — the two failure modes look nothing alike and the
+      # message should say which one happened.
+      - name: Ensure docker CLI
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            url="https://download.docker.com/linux/static/stable/$(uname -m)/docker-${DOCKER_CLI_VERSION}.tgz"
+            if command -v curl >/dev/null 2>&1; then curl -fsSL "$url" -o /tmp/docker.tgz
+            else wget -qO /tmp/docker.tgz "$url"; fi
+            tar -xzf /tmp/docker.tgz -C /usr/local/bin --strip-components=1 docker/docker
+          fi
+          docker --version
+          docker version >/dev/null 2>&1 || {
+            echo "The docker socket is not reachable from this job."
+            echo "act_runner must mount it: leave container.docker_host empty in its config.yaml."
+            exit 1
+          }
+
       - name: Registry login
         run: |
           printf '%s' "${{ secrets.REGISTRY_TOKEN }}" |