diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index ccb3aaa..56b7150 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -44,7 +44,6 @@ jobs:
     name: Full Project Check
     runs-on: ubuntu-latest
     timeout-minutes: 60
-
     steps:
       - uses: actions/checkout@v4
         with:
@@ -64,13 +63,10 @@ jobs:
 
       - name: Locate Docker daemon for local Dagger engine
         run: |
-          # Skip if remote Dagger engine is already configured (preferred path)
           if [ -n "${_DAGGER_RUNNER_HOST:-}" ]; then
             echo "Remote Dagger engine configured, no local Docker needed."
             exit 0
           fi
-
-          # Try host Docker socket (DooD) if runner mounts it
           if [ -S /var/run/docker.sock ]; then
             if DOCKER_HOST=unix:///var/run/docker.sock timeout 30 docker info >/dev/null 2>&1; then
               echo "Docker available via host socket."
@@ -78,17 +74,12 @@ jobs:
               exit 0
             fi
           fi
-
           echo "WARNING: No remote Dagger engine and no local Docker found." >&2
-          echo "  - Remote engine: check DAGGER_STUNNEL_URL secret and that the host proxy is running." >&2
-          echo "  - Local Docker: runner does not expose /var/run/docker.sock." >&2
-          echo "CI will likely fail at the Dagger step." >&2
+          exit 1
 
       - name: Prune Dagger cache before check
         env:
           DAGGER_NO_NAG: "1"
-        # prune(maxUsedSpace) also reclaims named cache volumes (gradle-cache, go-build-cache, etc.)
-        # when total cache exceeds the limit; without args only unreferenced entries are removed.
         run: |
           timeout 120 dagger query '{ engine { localCache { prune(maxUsedSpace: "75gb", targetSpace: "50gb") } } }' || true
 
@@ -104,9 +95,9 @@ jobs:
         run: |
           timeout 120 dagger query '{ engine { localCache { prune(maxUsedSpace: "75gb", targetSpace: "50gb") } } }' || true
 
-      - name: Cleanup TLS credentials
+      - name: Cleanup credentials
         if: always()
-        run: rm -rf ~/.ssh/dagger_key ~/.ssh/config.dagger /tmp/stunnel.pid
+        run: rm -rf ~/.ssh/dagger_key ~/.ssh/config.dagger
 
   merge-renovate:
     name: Auto-merge Renovate PR
@@ -114,7 +105,6 @@ jobs:
     if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'renovate/')
     runs-on: ubuntu-latest
     timeout-minutes: 5
-
     steps:
       - name: Merge if automerge label is set
         env:
@@ -123,27 +113,20 @@ jobs:
         run: |
           python3 - << 'PYEOF'
           import os, json, urllib.request, urllib.error, sys
-
           token = os.environ["FORGEJO_TOKEN"]
           url_base = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
           repo = os.environ.get("GITHUB_REPOSITORY", "")
           pr_number = os.environ["PR_NUMBER"]
           api = f"{url_base}/api/v1/repos/{repo}"
           headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
-
           req = urllib.request.Request(f"{api}/issues/{pr_number}/labels", headers=headers)
           with urllib.request.urlopen(req) as r:
               labels = [l["name"] for l in json.loads(r.read())]
-
           if "automerge" not in labels:
               print(f"PR #{pr_number}: no 'automerge' label — major update, skipping")
               sys.exit(0)
-
           body = json.dumps({"Do": "merge"}).encode()
-          req = urllib.request.Request(
-              f"{api}/pulls/{pr_number}/merge",
-              data=body, headers=headers, method="POST"
-          )
+          req = urllib.request.Request(f"{api}/pulls/{pr_number}/merge", data=body, headers=headers, method="POST")
           try:
               with urllib.request.urlopen(req) as r:
                   print(f"PR #{pr_number} merged successfully")