diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7d17e3d..66df78c 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -13,6 +13,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image EXTRAS=lint
       - name: Lint all
         run: |
@@ -64,7 +67,7 @@ jobs:
       - name: Set up environment
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image EXTRAS=ci,lint
       - name: Release dry-run validation
         env:
@@ -88,6 +91,9 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Detect changed paths
         id: detect
@@ -113,12 +119,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Discover available runners
         id: discover
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           MOLECULE_RUNNERS: ${{ vars.MOLECULE_RUNNERS }}
           PYTHONPATH: src
         run: |
@@ -140,6 +148,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image EXTRAS=ci,molecule
       - name: Install Ansible collections
         run: |
@@ -166,7 +177,6 @@ jobs:
         env:
           GITEA_URL: ${{ github.server_url }}
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           RUN_ID: ${{ github.run_id }}
           JOB_NAME: ${{ github.job }}
           MATRIX_INDEX: ${{ matrix.runner-index }}
@@ -184,11 +194,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Run automated PR review
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           set -euo pipefail
@@ -222,11 +234,13 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.CI_GITEA_TOKEN }}
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Squash merge with task ID
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
           PYTHONPATH: src
           DEVX_TASK_PREFIX: GRM
diff --git a/.gitea/workflows/post-merge.yml b/.gitea/workflows/post-merge.yml
index a0335c7..1b5e63d 100644
--- a/.gitea/workflows/post-merge.yml
+++ b/.gitea/workflows/post-merge.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Set up environment
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Check if this is a release commit
         id: check
@@ -67,7 +67,7 @@ jobs:
       - name: Set up environment
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Validate latest commit message
         env:
@@ -93,6 +93,9 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.CI_GITEA_TOKEN }}
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image EXTRAS=ci,lint
       - name: Configure git
         run: |
@@ -113,7 +116,6 @@ jobs:
         if: failure()
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           . .venv/bin/activate 2>/dev/null || true
@@ -134,12 +136,15 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ needs.release.outputs.tag }}
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image EXTRAS=ci,lint
       - name: Build and publish release
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           . .venv/bin/activate
@@ -151,7 +156,6 @@ jobs:
         if: failure()
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           . .venv/bin/activate 2>/dev/null || true
@@ -173,11 +177,13 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Sync documentation to wiki
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           . .venv/bin/activate
@@ -186,7 +192,6 @@ jobs:
         if: failure()
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
@@ -213,6 +218,9 @@ jobs:
           git fetch origin master
           git reset --hard origin/master
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image EXTRAS=lint
       - name: Generate and push badges
         env:
@@ -224,7 +232,6 @@ jobs:
         if: failure()
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
@@ -245,6 +252,9 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Update Vikunja task
         env:
@@ -259,7 +269,6 @@ jobs:
         if: failure()
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
@@ -278,11 +287,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image
       - name: Ensure branch protection and labels
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
           DEVX_REPO_NAME: grm
           DEVX_REPO_OWNER: oblachno-oss
@@ -294,7 +305,6 @@ jobs:
         if: failure()
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
diff --git a/Makefile b/Makefile
index 93953f8..e749757 100644
--- a/Makefile
+++ b/Makefile
@@ -63,13 +63,13 @@ setup-release: $(VENV)/bin/activate .env configure-gitea-pypi
 	$(BIN)/python -m devx.tools.setup --bin "$(BIN)" --skip-install --no-ansible-collections --no-pre-commit
 
 # Setup for pre-built image jobs (deps already in image, just link venv + install project)
-# Usage: make setup-image              (runtime deps only)
+# Usage: make setup-image              (runtime + ci deps, incl devx)
 #        make setup-image EXTRAS=lint  (runtime + lint deps, e.g. ansible-lint)
 #        make setup-image EXTRAS=ci,lint (runtime + ci + lint deps)
 setup-image:
 	@if [ -d /opt/venv ]; then ln -sf /opt/venv .venv; . .venv/bin/activate; \
 		if [ -n "$$CI_GITEA_TOKEN" ]; then export PIP_EXTRA_INDEX_URL="https://$$CI_GITEA_USERNAME:$$CI_GITEA_TOKEN@git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple/"; fi; \
-		pip install -e .$(if $(EXTRAS),[$(EXTRAS)],); \
+		pip install -e .$(if $(EXTRAS),[$(EXTRAS)],[ci]); \
 	else echo "[setup-image] /opt/venv not found — falling back to setup-ci"; $(MAKE) setup-ci; fi
 
 # Helper: run pip install with Gitea registry configured
diff --git a/pyproject.toml b/pyproject.toml
index 50625cc..eeec6f8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -35,7 +35,7 @@ ci = [
     "build>=1.5.0",
     "twine>=6.2.0",
     # Reusable CI/CD and dev tools (auto-merge, pr-review, pre-push checks, etc.)
-    "devx>=0.21.0",
+    "devx>=0.22.0",
 ]
 # Lint and type-checking tools (quality job)
 lint = [
@@ -55,7 +55,7 @@ molecule = [
 dev = [
     "gitea-runner-manager[ci,lint,molecule]",
     # Reusable CI/CD and dev tools (pre-push hooks, create-task, create-pr)
-    "devx>=0.21.0",
+    "devx>=0.22.0",
     # Non-Python dev dependency: checkmake (Makefile linter)
     # Install via: go install github.com/checkmake/checkmake/cmd/checkmake@latest
 ]