- Install Docker 27.5.1 static binary + compose v2 plugin instead of ancient docker.io from apt (API 1.41 vs required 1.44) - Read current GITEA_TOKEN from .env before rotation so the API call to change_admin_password uses a valid token, not the derived placeholder hash - Set DOCKER_HOST for the static binary