diff --git a/infra/Dockerfile.runner-base b/infra/Dockerfile.runner-base
index c76aea9..e1a1214 100644
--- a/infra/Dockerfile.runner-base
+++ b/infra/Dockerfile.runner-base
@@ -29,11 +29,7 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Docker CLI — daemon comes from the host socket mount, only CLI needed.
-RUN install -m 0755 -d /etc/apt/keyrings && \
-    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
-    chmod a+r /etc/apt/keyrings/docker.asc && \
-    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
-      > /etc/apt/sources.list.d/docker.list && \
-    apt-get update -qq && \
-    apt-get install -y -qq docker-ce-cli && \
+# docker.io from Ubuntu repos is sufficient for docker login + buildx.
+RUN apt-get update -qq && \
+    apt-get install -y -qq docker.io && \
     apt-get clean && rm -rf /var/lib/apt/lists/*