diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4d2d57d..3c1e735 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -50,9 +50,12 @@ jobs:
         run: npm run build
 
       - name: Install lftp
+        # The node:20-bookworm container runs as root and has no `sudo`, so call
+        # apt-get directly. openssh-client provides the `ssh` binary lftp uses
+        # for its SFTP connect-program.
         run: |
-          sudo apt-get update
-          sudo apt-get install -y lftp
+          apt-get update
+          apt-get install -y --no-install-recommends lftp openssh-client
 
       - name: Preflight — check SFTP host reachability
         env: