diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 5fdc1a2..77a95c5 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -19,7 +19,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -32,16 +32,33 @@ jobs:
       - run: npm run lint
       - run: npm run build
 
+      - name: Mark test complete
+        if: success()
+        run: mkdir -p "${RUNNER_TEMP}/ci-gate" && touch "${RUNNER_TEMP}/ci-gate/test"
+
+      - name: Test completion gate
+        if: always()
+        run: |
+          if [ ! -f "${RUNNER_TEMP}/ci-gate/test" ]; then
+            echo "::error::Test job incomplete (step cancelled — act_runner bug?). Re-run CI."
+            exit 1
+          fi
+
+  push-image:
+    needs: test
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
       - name: Wait for Docker daemon
-        if: github.event_name == 'push'
         run: bash scripts/ensure-docker-daemon.sh 240
 
       - name: Set up Docker Buildx
-        if: github.event_name == 'push'
         uses: docker/setup-buildx-action@v3
 
       - name: Build admin-ui image
-        if: github.event_name == 'push'
         run: |
           set -euo pipefail
           bash scripts/retry-docker-build.sh 5 60 -- \
@@ -55,7 +72,6 @@ jobs:
               .
 
       - name: Login to registry
-        if: github.event_name == 'push'
         uses: docker/login-action@v2
         with:
           registry: git.sabilin.com
@@ -63,7 +79,6 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Push admin-ui image
-        if: github.event_name == 'push'
         run: |
           set -euo pipefail
           TAG="sha-${GITHUB_SHA:0:12}"
@@ -75,8 +90,20 @@ jobs:
           bash scripts/retry-docker-build.sh 5 30 -- docker push "${REGISTRY}/eventhub-admin-ui:dev"
 
       - name: Prune old registry images
-        if: github.event_name == 'push'
+        continue-on-error: true
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: bash scripts/run-registry-prune.sh
+
+      - name: Mark push complete
+        if: success()
+        run: mkdir -p "${RUNNER_TEMP}/ci-gate" && touch "${RUNNER_TEMP}/ci-gate/push"
+
+      - name: Push completion gate
+        if: always()
+        run: |
+          if [ ! -f "${RUNNER_TEMP}/ci-gate/push" ]; then
+            echo "::error::Push job incomplete (step cancelled — act_runner bug?). Re-run CI."
+            exit 1
+          fi
diff --git a/.gitea/workflows/deploy-ift.yml b/.gitea/workflows/deploy-ift.yml
index 81fa0ce..4a39090 100644
--- a/.gitea/workflows/deploy-ift.yml
+++ b/.gitea/workflows/deploy-ift.yml
@@ -11,6 +11,9 @@ concurrency:
   group: eventhub-frontadmin-deploy-ift
   cancel-in-progress: false
 
+env:
+  REGISTRY: git.sabilin.com/eventhub
+
 jobs:
   deploy-ift-admin:
     if: |
@@ -19,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      - uses: actions/checkout@v4
+
       - name: Compute image tag
         id: meta
         run: |
@@ -30,6 +35,26 @@ jobs:
           fi
           echo "tag=sha-${SHA:0:12}" >> "$GITHUB_OUTPUT"
 
+      - name: Wait for Docker daemon
+        run: bash scripts/ensure-docker-daemon.sh 240
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: git.sabilin.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Verify admin-ui image from CI
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.meta.outputs.tag }}"
+          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub-admin-ui:${TAG}" >/dev/null 2>&1; then
+            echo "Образ eventhub-admin-ui:${TAG} не найден — CI push не завершился (ложный success runner?)."
+            exit 1
+          fi
+          echo "OK: eventhub-admin-ui:${TAG}"
+
       - name: Deploy admin on IFT via SSH
         uses: appleboy/ssh-action@v0.1.5
         with: