diff --git a/.gitea/workflows/deploy-stage.yml b/.gitea/workflows/deploy-stage.yml
index f707af9..1ec0284 100644
--- a/.gitea/workflows/deploy-stage.yml
+++ b/.gitea/workflows/deploy-stage.yml
@@ -5,6 +5,15 @@ on:
     tags:
       - 'v*'
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'Release tag (например v0.1.1)'
+        required: true
+        default: 'v0.1.1'
+      sha_tag:
+        description: 'Образ sha-* (например sha-3f5dde498652)'
+        required: true
+        default: 'sha-3f5dde498652'
 
 env:
   REGISTRY: git.sabilin.com/eventhub
@@ -13,19 +22,25 @@ jobs:
   deploy-stage-core:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Compute image tags
         id: meta
         run: |
-          echo "sha_tag=sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
-          echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "sha_tag=${{ github.event.inputs.sha_tag }}" >> "$GITHUB_OUTPUT"
+            echo "release_tag=${{ github.event.inputs.release_tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "sha_tag=sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+            echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Wait for Docker daemon
         run: bash scripts/ensure-docker-daemon.sh 240
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to registry
         uses: docker/login-action@v2
@@ -39,7 +54,7 @@ jobs:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
-          bash scripts/run-promote-images.sh \
+          bash scripts/clone-devops-run.sh scripts/promote-images.sh \
             "${{ steps.meta.outputs.sha_tag }}" \
             "${{ steps.meta.outputs.release_tag }}" \
             stage \
@@ -49,7 +64,7 @@ jobs:
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: bash scripts/run-registry-prune.sh
+        run: bash scripts/clone-devops-run.sh scripts/prune-registry-images.sh
 
       - name: Deploy core on stage via SSH
         uses: appleboy/ssh-action@v0.1.5
diff --git a/scripts/clone-devops-run.sh b/scripts/clone-devops-run.sh
new file mode 100644
index 0000000..5e667e8
--- /dev/null
+++ b/scripts/clone-devops-run.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# CI: clone EventHubDevOps и вызвать скрипт (не зависит от checkout тега).
+# Usage: clone-devops-run.sh <script-relative-to-devops> [args...]
+set -euo pipefail
+
+SCRIPT_REL="${1:?script path under devops/, e.g. scripts/promote-images.sh}"
+shift
+
+DEVOPS_REPO="${DEVOPS_REPO:-https://git.sabilin.com/EventHub/EventHubDevOps.git}"
+DEVOPS_REF="${DEVOPS_REF:-master}"
+
+if [[ -z "${REGISTRY_USER:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
+  echo "REGISTRY_USER/PASSWORD required"
+  exit 1
+fi
+
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "${WORKDIR}"' EXIT
+
+repo_path="${DEVOPS_REPO#https://}"
+git clone --depth 1 --branch "${DEVOPS_REF}" \
+  "https://${REGISTRY_USER}:${REGISTRY_PASSWORD}@${repo_path}" \
+  "${WORKDIR}/devops"
+
+exec bash "${WORKDIR}/devops/${SCRIPT_REL}" "$@"