diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 00eb445..b810295 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -30,6 +30,7 @@ jobs:
     needs: quality
     runs-on: docker
     strategy:
+      fail-fast: true
       matrix:
         runner-index: [0, 1, 2]
     steps:
@@ -44,6 +45,7 @@ jobs:
           echo "TEST_PAIRS=$PAIRS" >> $GITHUB_ENV
       - name: Run molecule tests
         run: |
+          set -e
           . .venv/bin/activate
           export DOCKER_HOST="unix:///run/user/$(id -u)/docker.sock"
           export ANSIBLE_INJECT_INVOCATION=1
diff --git a/ansible/roles/gitea-runner/defaults/main.yml b/ansible/roles/gitea-runner/defaults/main.yml
index 4f1395a..d364fca 100644
--- a/ansible/roles/gitea-runner/defaults/main.yml
+++ b/ansible/roles/gitea-runner/defaults/main.yml
@@ -32,7 +32,7 @@ gitea_runner_file: ".runner"
 # Docker installation (for rootless dependencies)
 docker_gpg_key_path: "/etc/apt/keyrings/docker.gpg"
 docker_apt_arch: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else ansible_facts['architecture'] }}"
-docker_apt_repo: >-
+docker_apt_source_line: >-
   deb [arch={{ docker_apt_arch }} signed-by={{ docker_gpg_key_path }}]
   https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
   {{ ansible_facts['distribution_release'] }} stable
diff --git a/ansible/roles/gitea-runner/tasks/rootless_docker.yml b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
index c63d159..1732e28 100644
--- a/ansible/roles/gitea-runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
@@ -16,9 +16,10 @@
   when: ansible_facts['os_family'] == 'Debian'
 
 - name: Add Docker APT repository (Debian/Ubuntu)
-  ansible.builtin.apt_repository:
-    repo: "{{ docker_apt_repo }}"
-    state: present
+  ansible.builtin.copy:
+    dest: /etc/apt/sources.list.d/docker.list
+    content: "{{ docker_apt_source_line }}\n"
+    mode: "0644"
   when: ansible_facts['os_family'] == 'Debian'
 
 - name: Update apt cache after adding Docker repo (Debian/Ubuntu)
@@ -27,30 +28,6 @@
     cache_valid_time: 0
   when: ansible_facts['os_family'] == 'Debian'
 
-- name: Debug apt sources (Debian/Ubuntu)
-  ansible.builtin.shell: |
-    set -o pipefail
-    cat /etc/apt/sources.list.d/*.list /etc/apt/sources.list 2>/dev/null | grep -i docker || true
-  register: apt_docker_sources
-  changed_when: false
-  when: ansible_facts['os_family'] == 'Debian'
-
-- name: Show apt docker sources
-  ansible.builtin.debug:
-    var: apt_docker_sources.stdout_lines
-  when: ansible_facts['os_family'] == 'Debian'
-
-- name: Debug apt-cache search docker-ce
-  ansible.builtin.shell: apt-cache search docker-ce 2>/dev/null || true
-  register: apt_search_result
-  changed_when: false
-  when: ansible_facts['os_family'] == 'Debian'
-
-- name: Show apt-cache search result
-  ansible.builtin.debug:
-    var: apt_search_result.stdout_lines
-  when: ansible_facts['os_family'] == 'Debian'
-
 - name: Install rootless Docker dependencies (Debian/Ubuntu)
   ansible.builtin.apt:
     name: