diff --git a/.gitea/workflows/cicd-start.yaml b/.gitea/workflows/cicd-start.yaml
index 29a2986..ee4933d 100644
--- a/.gitea/workflows/cicd-start.yaml
+++ b/.gitea/workflows/cicd-start.yaml
@@ -81,29 +81,37 @@ jobs:
       - name: Compute base hash and base-needed signal
         id: base-decision
         env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          REPO_FULL: ${{ github.repository }}
         run: |
           set -e
-          umask 077
-          trap 'rm -f ~/.ssh/id_rsa' EXIT
 
-          if [ -z "${SSH_PRIVATE_KEY}" ]; then
-            echo "❌ SSH_PRIVATE_KEY is empty"
+          API_BASE="http://kankali.darkhelm.lan:3000/api/v1"
+          REPO_OWNER="${REPO_FULL%/*}"
+          REPO_NAME="${REPO_FULL#*/}"
+
+          if [ -z "${PACKAGE_ACCESS_TOKEN}" ]; then
+            echo "❌ PACKAGE_ACCESS_TOKEN is empty"
             exit 1
           fi
 
-          mkdir -p ~/.ssh
-          echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+          mkdir -p scripts
 
-          GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
-            git clone --depth 1 --no-checkout "${GITEA_REPO_SSH_URL}" .
+          curl -fsS \
+            -H "Authorization: token ${PACKAGE_ACCESS_TOKEN}" \
+            "${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/raw/Dockerfile.cicd-base?ref=${GITHUB_SHA}" \
+            -o Dockerfile.cicd-base
 
-          GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
-            git fetch --depth 1 origin "${GITHUB_SHA}" >/dev/null 2>&1 || true
+          curl -fsS \
+            -H "Authorization: token ${PACKAGE_ACCESS_TOKEN}" \
+            "${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/raw/.dockerignore?ref=${GITHUB_SHA}" \
+            -o .dockerignore
+
+          curl -fsS \
+            -H "Authorization: token ${PACKAGE_ACCESS_TOKEN}" \
+            "${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/raw/scripts/compute-cicd-base-hash.sh?ref=${GITHUB_SHA}" \
+            -o scripts/compute-cicd-base-hash.sh
 
-          git checkout FETCH_HEAD -- Dockerfile.cicd-base .dockerignore scripts/compute-cicd-base-hash.sh
           chmod +x scripts/compute-cicd-base-hash.sh
 
           BASE_HASH=$(./scripts/compute-cicd-base-hash.sh)
@@ -131,6 +139,7 @@ jobs:
           echo "base_needed=true" >> "$GITHUB_OUTPUT"
 
       - name: Dispatch downstream workflow
+        if: steps.base-decision.outcome == 'success' && steps.base-decision.outputs.head_sha != '' && steps.base-decision.outputs.base_needed != ''
         env:
           PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }}