diff --git a/.forgejo/workflows/deploy-cfn.yml b/.forgejo/workflows/deploy-cfn.yml
index 0b772cf..47e2279 100644
--- a/.forgejo/workflows/deploy-cfn.yml
+++ b/.forgejo/workflows/deploy-cfn.yml
@@ -28,13 +28,37 @@ jobs:
           echo "SRC_DIR=${SRC_DIR}" >> "$GITHUB_ENV"
           echo "Using source directory: ${SRC_DIR}"
 
-      - name: Ensure Docker is available
+      - name: Ensure AWS CLI
         run: |
-          if ! command -v docker >/dev/null 2>&1; then
-            echo "docker is not available on this runner."
-            exit 1
+          set -e
+          if command -v aws >/dev/null 2>&1; then
+            aws --version
+            exit 0
           fi
-          docker --version
+
+          # Try local AWS CLI v2 install (no root required).
+          if command -v curl >/dev/null 2>&1 && command -v unzip >/dev/null 2>&1; then
+            TMP_DIR="$(mktemp -d)"
+            curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "${TMP_DIR}/awscliv2.zip"
+            unzip -q "${TMP_DIR}/awscliv2.zip" -d "${TMP_DIR}"
+            "${TMP_DIR}/aws/install" -i "$HOME/.aws-cli" -b "$HOME/.local/bin" || true
+            if [ -x "$HOME/.local/bin/aws" ]; then
+              echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+              "$HOME/.local/bin/aws" --version
+              exit 0
+            fi
+          fi
+
+          # Fallback to pip user install.
+          if command -v python3 >/dev/null 2>&1; then
+            python3 -m pip install --user --upgrade awscli
+            echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+            "$HOME/.local/bin/aws" --version
+            exit 0
+          fi
+
+          echo "Unable to install aws CLI on this runner."
+          exit 1
 
       - name: Check required AWS secrets
         run: |
@@ -50,36 +74,19 @@ jobs:
       - name: Verify AWS identity
         run: |
           set -e
-          if ! docker run --rm \
-            -e AWS_ACCESS_KEY_ID \
-            -e AWS_SECRET_ACCESS_KEY \
-            -e AWS_SESSION_TOKEN \
-            -e AWS_DEFAULT_REGION \
-            amazon/aws-cli:2 sts get-caller-identity; then
+          if ! aws sts get-caller-identity; then
             echo "AWS authentication failed. If using STS creds, regenerate and update all 3 secrets: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN."
             exit 1
           fi
 
       - name: Validate CFT
         run: |
-          docker run --rm \
-            -e AWS_ACCESS_KEY_ID \
-            -e AWS_SECRET_ACCESS_KEY \
-            -e AWS_SESSION_TOKEN \
-            -e AWS_DEFAULT_REGION \
-            -v "$PWD/${SRC_DIR}/infra:/infra" \
-            amazon/aws-cli:2 cloudformation validate-template \
-            --template-body file:///infra/hello-lambda.yml
+          aws cloudformation validate-template \
+            --template-body "file://${SRC_DIR}/infra/hello-lambda.yml"
 
       - name: Deploy CFT
         run: |
-          docker run --rm \
-            -e AWS_ACCESS_KEY_ID \
-            -e AWS_SECRET_ACCESS_KEY \
-            -e AWS_SESSION_TOKEN \
-            -e AWS_DEFAULT_REGION \
-            -v "$PWD/${SRC_DIR}/infra:/infra" \
-            amazon/aws-cli:2 cloudformation deploy \
+          aws cloudformation deploy \
             --stack-name hello-lambda-stack \
-            --template-file /infra/hello-lambda.yml \
+            --template-file "${SRC_DIR}/infra/hello-lambda.yml" \
             --capabilities CAPABILITY_NAMED_IAM