diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 5978943..ff74a71 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -47,6 +47,7 @@ jobs:
           go version
           node --version
           pnpm --version
+          docker --version
           docker-compose version
           shellcheck --version
           trivy --version
diff --git a/.gitea/workflows/release-ci.yml b/.gitea/workflows/release-ci.yml
index 80b389b..a5dbdef 100644
--- a/.gitea/workflows/release-ci.yml
+++ b/.gitea/workflows/release-ci.yml
@@ -31,6 +31,7 @@ jobs:
           go version
           node --version
           pnpm --version
+          docker --version
           docker-compose version
           shellcheck --version
           trivy --version
diff --git a/docs/runbooks/production-ci-cd.md b/docs/runbooks/production-ci-cd.md
index f3e7a9c..ad30679 100644
--- a/docs/runbooks/production-ci-cd.md
+++ b/docs/runbooks/production-ci-cd.md
@@ -16,7 +16,7 @@
 
 生产 CD 由部署仓的 root-owned dispatcher 执行。它在相同源码 SHA 上同时等待 `ci / verify (push)` 与本次新产生的 `release-ci / verify-tag (push)` 成功，然后只运行部署仓中固定的 BuildKit 构建、Trivy 镜像扫描、digest 发布、备份、迁移、健康检查和回滚命令；不得执行 Tag checkout 中的 `pnpm`、测试、shell 脚本或应用程序。
 
-provision 安装 checksum-pinned 的官方静态 ShellCheck `0.11.0` 和 Docker Compose `5.3.1`，不会依赖宿主是否预装这些命令。所有下载都在使用前校验固定 SHA-256，并在精确 Node Job 镜像内实际执行版本检查。
+provision 安装 checksum-pinned 的官方静态 ShellCheck `0.11.0`、Docker Compose `5.3.1`，并从固定 digest 的 Runner 镜像提取 Docker CLI `29.6.0` 后校验二进制 SHA-256；不会依赖宿主是否预装这些命令。所有工具都在精确 Node Job 镜像内实际执行版本检查。
 
 ## 首次安装或修复 CI Runner
 
diff --git a/scripts/provision-ci-runner.sh b/scripts/provision-ci-runner.sh
index 6426a09..8cf4848 100755
--- a/scripts/provision-ci-runner.sh
+++ b/scripts/provision-ci-runner.sh
@@ -26,6 +26,8 @@ SHELLCHECK_VERSION=0.11.0
 SHELLCHECK_SHA256=8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
 COMPOSE_VERSION=5.3.1
 COMPOSE_SHA256=f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959
+DOCKER_CLI_VERSION=29.6.0
+DOCKER_CLI_SHA256=80b40fa11d797a71ea15f9a31e7004790ddac95f58a8222a40c08f08a639faba
 PNPM_VERSION=10.18.1
 RUNNER_IMAGE='docker.io/gitea/runner:2.0.0-dind-rootless@sha256:5b7b625ff773d0ee761788c47582503ec1b241fa5b81edebad48a57e663f4f3a'
 JOB_IMAGE='docker.io/library/node:24.16.0-bookworm@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7'
@@ -188,14 +190,25 @@ tar -xzf "$PREFIX/downloads/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C "$PREF
 chmod 0755 "$PREFIX/bin/trivy"
 GOBIN="$PREFIX/bin" GOPROXY="${GO_MODULE_PROXY:-https://goproxy.cn,direct}" \
   "$PREFIX/toolchains/go/bin/go" install golang.org/x/vuln/cmd/govulncheck@v1.6.0
-chown -R root:root "$PREFIX"
-chmod -R go-w "$PREFIX"
 
 require_free_space "$MIN_FREE_GIB" "runner image pull"
 docker pull "$RUNNER_IMAGE_SOURCE"
 runner_runtime_image=$(docker image inspect --format '{{.Id}}' "$RUNNER_IMAGE_SOURCE")
 printf '%s\n' "$runner_runtime_image" | grep -Eq '^sha256:[0-9a-f]{64}$' || \
   fail "pinned runner image did not resolve to an immutable local image ID"
+
+# The job image intentionally contains no Docker client. Extract the static CLI
+# from the immutable Runner image, then verify its binary digest before exposing
+# it through the read-only CI toolchain mount.
+docker_cli_download="$PREFIX/downloads/docker-${DOCKER_CLI_VERSION}-linux-x86_64"
+docker run --rm --pull=never --entrypoint /bin/cat "$runner_runtime_image" \
+  /usr/local/bin/docker > "$docker_cli_download"
+printf '%s  %s\n' "$DOCKER_CLI_SHA256" "$docker_cli_download" | sha256sum -c -
+install -m 0755 "$docker_cli_download" "$PREFIX/bin/docker"
+"$PREFIX/bin/docker" --version | grep -Fq "Docker version ${DOCKER_CLI_VERSION},"
+chown -R root:root "$PREFIX"
+chmod -R go-w "$PREFIX"
+
 require_free_space "$MIN_POST_INSTALL_FREE_GIB" "completed runner image pull"
 docker volume create "$RUNNER_VOLUME" >/dev/null
 
@@ -298,6 +311,7 @@ docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
     go version
     node --version
     pnpm --version
+    docker --version
     docker-compose version
     shellcheck --version
     trivy --version
diff --git a/tests/ci/pipeline-test.sh b/tests/ci/pipeline-test.sh
index bfdedbf..a6edbe1 100755
--- a/tests/ci/pipeline-test.sh
+++ b/tests/ci/pipeline-test.sh
@@ -116,6 +116,7 @@ for quality_workflow in "$workflow" "$release_workflow"; do
   grep -Fq './tests/ci/pipeline-test.sh' "$quality_workflow"
   grep -Fq './tests/ci/semver-test.sh' "$quality_workflow"
   grep -Fq 'docker-compose version' "$quality_workflow"
+  grep -Fq 'docker --version' "$quality_workflow"
   grep -Fq 'docker-compose -f docker-compose.yml config --quiet' "$quality_workflow"
   if grep -Fq 'docker compose' "$quality_workflow"; then
     echo 'job container must use the read-only standalone Compose binary' >&2
@@ -264,6 +265,8 @@ grep -q '^SHELLCHECK_VERSION=0.11.0$' "$provision"
 grep -q '^SHELLCHECK_SHA256=8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198$' "$provision"
 grep -q '^COMPOSE_VERSION=5.3.1$' "$provision"
 grep -q '^COMPOSE_SHA256=f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959$' "$provision"
+grep -q '^DOCKER_CLI_VERSION=29.6.0$' "$provision"
+grep -q '^DOCKER_CLI_SHA256=80b40fa11d797a71ea15f9a31e7004790ddac95f58a8222a40c08f08a639faba$' "$provision"
 grep -Fq 'RUNNER_NAME=${RUNNER_NAME:-easyai-gateway-ci-unprivileged-v2}' "$provision"
 grep -Fq "RUNNER_IMAGE='$runner_image'" "$provision"
 grep -Fq 'RUNNER_IMAGE_SOURCE=${CI_RUNNER_IMAGE_SOURCE:-$RUNNER_IMAGE}' "$provision"
@@ -293,6 +296,10 @@ grep -Fq 'shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz' "$provision"
 grep -Fq 'docker-compose-linux-x86_64' "$provision"
 grep -Fq 'install -m 0755 "$PREFIX/downloads/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "$PREFIX/bin/shellcheck"' "$provision"
 grep -Fq 'install -m 0755 "$PREFIX/downloads/docker-compose-${COMPOSE_VERSION}-linux-x86_64" "$PREFIX/bin/docker-compose"' "$provision"
+grep -Fq 'docker run --rm --pull=never --entrypoint /bin/cat "$runner_runtime_image"' "$provision"
+grep -Fq 'printf '\''%s  %s\n'\'' "$DOCKER_CLI_SHA256" "$docker_cli_download" | sha256sum -c -' "$provision"
+grep -Fq 'install -m 0755 "$docker_cli_download" "$PREFIX/bin/docker"' "$provision"
+grep -Fq '"$PREFIX/bin/docker" --version' "$provision"
 grep -Fq 'PATH="$PREFIX/toolchains/node/bin:$PATH"' "$provision"
 grep -Fq 'gpasswd -d easyai-gateway-ci-v2 docker' "$provision"
 grep -Fq 'gpasswd -d easyai-gateway-ci-v2 sudo' "$provision"