diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5255d07..1d010a1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,27 +25,29 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  # The self-hosted act_runner network can terminate index.crates.io with a
-  # certificate that does not match the sparse-index hostname. Use Cargo's git
-  # index path in CI; GitHub access is already required for the actions above.
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: git
 
 jobs:
   build-test:
     name: Build + Clippy + Test
     runs-on: ubuntu-latest
+    env:
+      HTTP_PROXY: http://172.17.0.1:7897
+      HTTPS_PROXY: http://172.17.0.1:7897
+      NO_PROXY: localhost,127.0.0.1,server,db,gitea.dailz.cn,gitea.com
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@v4
 
       - name: Install Rust toolchain (stable)
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - name: Install system dependencies
         run: |
+          echo 'Acquire::http::Proxy "http://172.17.0.1:7897";' | sudo tee /etc/apt/apt.conf.d/99proxy
+          echo 'Acquire::https::Proxy "http://172.17.0.1:7897";' | sudo tee -a /etc/apt/apt.conf.d/99proxy
           APT_OPTS=(-o Acquire::Retries=5 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30)
-          sudo apt-get "${APT_OPTS[@]}" update --error-on=any
+          sudo apt-get "${APT_OPTS[@]}" update
           # NOTE: do NOT use --no-install-recommends for libclang-dev — on
           # Debian Bookworm (the node:20-bookworm image used by act_runner
           # under ubuntu-latest) the recommended toolchain bits are needed
@@ -53,25 +55,13 @@ jobs:
           # are also more reliable without the flag.
           sudo apt-get "${APT_OPTS[@]}" install -y \
             ffmpeg \
-            libavcodec-dev libavfilter-dev libavformat-dev libavutil-dev libswscale-dev libva-dev \
+            libavcodec-dev libavdevice-dev libavfilter-dev libavformat-dev libavutil-dev libswscale-dev libva-dev \
             libwayland-dev wayland-protocols \
             libdrm-dev \
             libpipewire-0.3-dev \
             libclang-dev clang
 
       - name: Resolve LIBCLANG_PATH
-        # bindgen needs libclang on the LD path. The actual install location
-        # varies by Debian/Ubuntu version (llvm-14, llvm-15, ...), so we
-        # discover it dynamically instead of hardcoding /usr/lib/llvm-14/lib.
-        # Writing to $GITHUB_ENV propagates the value to subsequent steps
-        # inside the act_runner Docker container; the workflow-level `env:`
-        # block is not reliably visible there.
-        #
-        # Find pattern note: Debian Bookworm installs the runtime library as
-        # `libclang-14.so.1` (versioned, no plain libclang.so.* symlink),
-        # so a strict 'libclang.so.*' pattern returns nothing. The broader
-        # 'libclang*.so*' matches every bindgen-compatible filename variant:
-        # libclang.so, libclang-14.so, libclang.so.1, libclang-14.so.1.
         run: |
           set -e
           LIBCL=$(find /usr -name 'libclang*.so*' 2>/dev/null | head -1)
@@ -80,17 +70,6 @@ jobs:
           echo "Resolved LIBCLANG_PATH=$LIBDIR (found $LIBCL)"
           echo "LIBCLANG_PATH=$LIBDIR" >> "$GITHUB_ENV"
 
-      - name: Cache cargo registry + build artifacts
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock', 'Cargo.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
       - name: Clippy (release, all targets)
         run: cargo clippy --release --all-targets
 
@@ -103,13 +82,17 @@ jobs:
   audit:
     name: Security audit (RUSTSEC)
     runs-on: ubuntu-latest
-    # Keep separate from build-test so a vulnerability advisory fails the
-    # check independently of compile state.
+    env:
+      HTTP_PROXY: http://172.17.0.1:7897
+      HTTPS_PROXY: http://172.17.0.1:7897
+      NO_PROXY: localhost,127.0.0.1,server,db,gitea.dailz.cn,gitea.com
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@v4
 
       - name: Install Rust toolchain (stable)
-        uses: dtolnay/rust-toolchain@stable
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked