diff --git a/.gitea/workflows/cicd.yml b/.gitea/workflows/cicd.yml
index 53fc818..fd0d74a 100644
--- a/.gitea/workflows/cicd.yml
+++ b/.gitea/workflows/cicd.yml
@@ -70,6 +70,7 @@ jobs:
       - name: Minimal checkout for base Dockerfile
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          GITHUB_SHA: ${{ github.sha }}
         run: |
           umask 077
           trap 'rm -f ~/.ssh/id_rsa' EXIT
@@ -96,8 +97,16 @@ jobs:
             git clone --depth 1 --no-checkout \
             "${GITEA_REPO_SSH_URL}" .
 
-          # Checkout only the base Dockerfile and dockerignore
-          git checkout HEAD -- Dockerfile.cicd-base .dockerignore
+          # Checkout from the exact workflow commit SHA when available.
+          if [ -n "${GITHUB_SHA}" ] && \
+             GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
+             git fetch --depth 1 origin "${GITHUB_SHA}" >/dev/null 2>&1; then
+            git checkout FETCH_HEAD -- Dockerfile.cicd-base .dockerignore
+            echo "✓ Checked out Dockerfile.cicd-base from commit ${GITHUB_SHA}"
+          else
+            git checkout HEAD -- Dockerfile.cicd-base .dockerignore
+            echo "⚠ Falling back to default branch HEAD for Dockerfile checkout"
+          fi
 
           # Clean up SSH key for security
           rm -f ~/.ssh/id_rsa
@@ -256,6 +265,7 @@ jobs:
       - name: Minimal checkout for Dockerfile
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          GITHUB_SHA: ${{ github.sha }}
         run: |
           umask 077
           trap 'rm -f ~/.ssh/id_rsa' EXIT
@@ -282,8 +292,16 @@ jobs:
             git clone --depth 1 --no-checkout \
             "${GITEA_REPO_SSH_URL}" .
 
-          # Checkout Dockerfiles and dockerignore (include base for fallback)
-          git checkout HEAD -- Dockerfile.cicd Dockerfile.cicd-base .dockerignore
+          # Checkout from the exact workflow commit SHA when available.
+          if [ -n "${GITHUB_SHA}" ] && \
+             GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
+             git fetch --depth 1 origin "${GITHUB_SHA}" >/dev/null 2>&1; then
+            git checkout FETCH_HEAD -- Dockerfile.cicd Dockerfile.cicd-base .dockerignore
+            echo "✓ Checked out Dockerfiles from commit ${GITHUB_SHA}"
+          else
+            git checkout HEAD -- Dockerfile.cicd Dockerfile.cicd-base .dockerignore
+            echo "⚠ Falling back to default branch HEAD for Dockerfile checkout"
+          fi
 
           # Clean up SSH key for security
           rm -f ~/.ssh/id_rsa
diff --git a/Dockerfile.cicd b/Dockerfile.cicd
index 6296f18..75393eb 100644
--- a/Dockerfile.cicd
+++ b/Dockerfile.cicd
@@ -89,11 +89,7 @@ WORKDIR /workspace/frontend
 RUN echo "=== Installing Frontend Dependencies (Phase 2: Optimized Caching) ===" && \
     echo "Available global tools (installed via npm):" && \
     npm list -g --depth=0 2>/dev/null | head -10 || echo "Global npm tools available" && \
-    which tsc && which eslint && which prettier || echo "Global tools verified" && \
-    # Create temporary swap file for memory-intensive yarn install
-    dd if=/dev/zero of=/tmp/swapfile bs=1M count=1024 2>/dev/null && \
-    mkswap /tmp/swapfile && \
-    swapon /tmp/swapfile || echo "Swap setup failed, continuing without swap"
+    which tsc && which eslint && which prettier || echo "Global tools verified"
 
 # Install frontend dependencies from extracted package.json (this layer will cache!)
 RUN if [ -f "package.json" ]; then \
@@ -103,21 +99,16 @@ RUN if [ -f "package.json" ]; then \
         echo "Memory info before install:" && \
         free -h || true && \
         INSTALL_SUCCESS=false && \
-        for i in 1 2 3; do \
-            echo "Attempt $i: Installing project-specific frontend dependencies..." && \
-            echo "(Common dev tools pre-installed globally for performance)" && \
-            timeout 2400 yarn install --immutable --mode=skip-build \
-            && { INSTALL_SUCCESS=true; break; } || \
-            (echo "Attempt $i failed, cleaning up and retrying..." && \
-             rm -rf node_modules .yarn/cache .yarn/install-state.gz && \
-             yarn cache clean --all 2>/dev/null || true && \
-             sleep 60); \
-        done && \
+        echo "Attempt 1/1: Installing project-specific frontend dependencies..." && \
+        echo "(Common dev tools pre-installed globally for performance)" && \
+        timeout 1200 yarn install --immutable --mode=skip-build \
+        && INSTALL_SUCCESS=true || \
+        (echo "Attempt failed, cleaning up..." && \
+         rm -rf node_modules .yarn/cache .yarn/install-state.gz && \
+         yarn cache clean --all 2>/dev/null || true) && \
         rm -rf .yarn/cache && \
-        swapoff /tmp/swapfile 2>/dev/null || true && \
-        rm -f /tmp/swapfile && \
         if [ "$INSTALL_SUCCESS" = "false" ]; then \
-            echo "WARNING: Frontend dependencies installation failed after 3 attempts"; \
+            echo "WARNING: Frontend dependencies installation failed"; \
             echo "Continuing without frontend dependencies for CI/CD environment"; \
             touch .frontend-deps-failed; \
         else \