diff --git a/ansible/roles/gitea-runner/defaults/main.yml b/ansible/roles/gitea-runner/defaults/main.yml
index 166fb23..70653c7 100644
--- a/ansible/roles/gitea-runner/defaults/main.yml
+++ b/ansible/roles/gitea-runner/defaults/main.yml
@@ -31,3 +31,7 @@ gitea_runner_file: ".runner"
 
 # Docker installation (for rootless dependencies)
 docker_gpg_key_path: "/etc/apt/keyrings/docker.gpg"
+docker_apt_repo: >-
+  deb [arch={{ ansible_facts['architecture'] }} signed-by={{ docker_gpg_key_path }}]
+  https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
+  {{ ansible_facts['distribution_release'] }} stable
diff --git a/ansible/roles/gitea-runner/tasks/rootless_docker.yml b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
index b16ccc8..e0e76cd 100644
--- a/ansible/roles/gitea-runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
@@ -9,7 +9,7 @@
 - name: Download and dearmor Docker GPG key (Debian/Ubuntu)
   ansible.builtin.shell: |
     set -o pipefail
-    curl -fsSL "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg" | gpg --dearmor -o {{ docker_gpg_key_path }}
+    curl -fsSL "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg" | gpg --dearmor --yes -o {{ docker_gpg_key_path }}
   args:
     creates: "{{ docker_gpg_key_path }}"
     executable: /bin/bash
@@ -17,12 +17,14 @@
 
 - name: Add Docker APT repository (Debian/Ubuntu)
   ansible.builtin.apt_repository:
-    repo: >-
-      deb [arch={{ ansible_facts['architecture'] }} signed-by={{ docker_gpg_key_path }}]
-      https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
-      {{ ansible_facts['distribution_release'] }} stable
+    repo: "{{ docker_apt_repo }}"
     state: present
+  when: ansible_facts['os_family'] == 'Debian'
+
+- name: Update apt cache after adding Docker repo (Debian/Ubuntu)
+  ansible.builtin.apt:
     update_cache: true
+    cache_valid_time: 0
   when: ansible_facts['os_family'] == 'Debian'
 
 - name: Install rootless Docker dependencies (Debian/Ubuntu)
@@ -38,8 +40,6 @@
       - docker-compose-plugin
       - rsync
     state: present
-    update_cache: true
-    cache_valid_time: 0
   when: ansible_facts['os_family'] == 'Debian'
 
 - name: Install rootless Docker dependencies (Arch Linux)