diff --git a/.gitea/workflows/deploy-stage.yml b/.gitea/workflows/deploy-stage.yml
index 176efb7..d07a21d 100644
--- a/.gitea/workflows/deploy-stage.yml
+++ b/.gitea/workflows/deploy-stage.yml
@@ -5,6 +5,15 @@ on:
     tags:
       - 'v*'
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'Release tag (например v0.1.1)'
+        required: true
+        default: 'v0.1.1'
+      sha_tag:
+        description: 'Образ sha-* (например sha-3f5dde498652)'
+        required: true
+        default: 'sha-3f5dde498652'
 
 env:
   REGISTRY: git.sabilin.com/eventhub
@@ -13,16 +22,22 @@ jobs:
   deploy-stage-admin:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Compute image tags
         id: meta
         run: |
-          echo "sha_tag=sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
-          echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "sha_tag=${{ github.event.inputs.sha_tag }}" >> "$GITHUB_OUTPUT"
+            echo "release_tag=${{ github.event.inputs.release_tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "sha_tag=sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+            echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to registry
         uses: docker/login-action@v2
@@ -36,16 +51,17 @@ jobs:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
-          bash scripts/run-promote-images.sh \
+          bash scripts/clone-devops-run.sh scripts/promote-images.sh \
             "${{ steps.meta.outputs.sha_tag }}" \
             "${{ steps.meta.outputs.release_tag }}" \
-            stage
+            stage \
+            eventhub-admin-ui
 
       - name: Prune old registry images
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: bash scripts/run-registry-prune.sh
+        run: bash scripts/clone-devops-run.sh scripts/prune-registry-images.sh
 
       - name: Deploy admin on stage via SSH
         uses: appleboy/ssh-action@v0.1.5
@@ -56,4 +72,4 @@ jobs:
           script: |
             export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
             export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            /opt/eventhub-stage/devops/scripts/deploy-service.sh stage admin ${{ steps.meta.outputs.release_tag }}
+            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage admin ${{ steps.meta.outputs.release_tag }}
diff --git a/scripts/clone-devops-run.sh b/scripts/clone-devops-run.sh
new file mode 100644
index 0000000..127edfc
--- /dev/null
+++ b/scripts/clone-devops-run.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# CI: clone EventHubDevOps и вызвать скрипт.
+set -euo pipefail
+
+SCRIPT_REL="${1:?script path under devops/}"
+shift
+
+DEVOPS_REPO="${DEVOPS_REPO:-https://git.sabilin.com/EventHub/EventHubDevOps.git}"
+DEVOPS_REF="${DEVOPS_REF:-master}"
+
+if [[ -z "${REGISTRY_USER:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
+  echo "REGISTRY_USER/PASSWORD required"
+  exit 1
+fi
+
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "${WORKDIR}"' EXIT
+
+repo_path="${DEVOPS_REPO#https://}"
+git clone --depth 1 --branch "${DEVOPS_REF}" \
+  "https://${REGISTRY_USER}:${REGISTRY_PASSWORD}@${repo_path}" \
+  "${WORKDIR}/devops"
+
+exec bash "${WORKDIR}/devops/${SCRIPT_REL}" "$@"