diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index ec48995..bbc5de1 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -33,7 +33,7 @@ env:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: docker-build
     steps:
       - uses: actions/checkout@v4
         with:
@@ -63,7 +63,19 @@ jobs:
           sudo apt-get install -y jq wine
 
       - name: Ensure PowerShell
-        run: command -v pwsh >/dev/null || sudo snap install powershell --classic
+        # Debian ships no snapd by default, so this pulls Microsoft's portable
+        # linux-x64 tarball instead — no package repo or GPG key setup needed.
+        # A no-op on repeat runs once it's on PATH, since this runner is a
+        # persistent host, not a fresh container per job.
+        run: |
+          if command -v pwsh >/dev/null; then exit 0; fi
+          url=$(curl -sL https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
+            | jq -r '.assets[] | select(.name | test("linux-x64\\.tar\\.gz$")) | .browser_download_url')
+          [ -n "$url" ] || { echo "could not resolve a PowerShell linux-x64 release asset" >&2; exit 1; }
+          sudo mkdir -p /opt/microsoft/powershell/7
+          curl -sL "$url" | sudo tar xz -C /opt/microsoft/powershell/7
+          sudo ln -sf /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
+          sudo chmod +x /opt/microsoft/powershell/7/pwsh
 
       - name: Build Windows installers + Linux AppImage
         shell: pwsh