diff --git a/.gitea/workflows/sync-public.yml b/.gitea/workflows/sync-public.yml
index 66c60e1..454ce5a 100644
--- a/.gitea/workflows/sync-public.yml
+++ b/.gitea/workflows/sync-public.yml
@@ -1,5 +1,4 @@
 name: Sync public mirror
-
 on:
   push:
     branches: [ main ]
@@ -7,11 +6,11 @@ on:
 jobs:
   sync:
     runs-on: ubuntu-latest
+    container: node:20-alpine
 
     steps:
-      - name: Install tools (rsync)
-        run: |
-          sudo apt-get update && sudo apt-get install -y rsync
+      - name: Install tools
+        run: apk add --no-cache git rsync openssh-client bash
 
       - name: Checkout private repo
         uses: actions/checkout@v4
@@ -30,41 +29,25 @@ jobs:
           ssh-keyscan -p 22 192.168.1.15 >> ~/.ssh/known_hosts
 
       - name: Clone public repo
-        run: |
-          git clone --depth 1 ssh://git@192.168.1.15:22/Bausager/Flux-oss.git /tmp/public
+        run: git clone --depth 1 ssh://git@192.168.1.15:22/Bausager/Flux-oss.git /tmp/public
 
       - name: Sync files using .gitea/workflows/oss-keep.txt
         run: |
           set -euo pipefail
-
           KEEP_FILE=".gitea/workflows/oss-keep.txt"
           INCLUDE_FILE="$(pwd)/.oss-include.rsync"
-
-          echo "Generating rsync include list from $KEEP_FILE"
           : > "$INCLUDE_FILE"
-          echo "## Generated from $KEEP_FILE" >> "$INCLUDE_FILE"
           echo "+ */" >> "$INCLUDE_FILE"
-
           while IFS= read -r line; do
-            line="${line%%#*}"
-            line="$(echo "$line" | xargs || true)"
+            line="${line%%#*}"; line="$(echo "$line" | xargs || true)"
             [ -z "$line" ] && continue
             case "$line" in
-              !*)
-                pat="${line#!}"
-                echo "- $pat" >> "$INCLUDE_FILE"
-                ;;
-              *)
-                echo "+ $line" >> "$INCLUDE_FILE"
-                ;;
+              !*) echo "- ${line#!}";;
+              *)  echo "+ $line";;
             esac
-          done < "$KEEP_FILE"
-
+          done >> "$INCLUDE_FILE"
           echo "- *" >> "$INCLUDE_FILE"
-          echo "Rsync include rules:"
-          cat "$INCLUDE_FILE"
 
-          echo "Syncing files to /tmp/public"
           rsync -a --delete --prune-empty-dirs \
             --exclude '.git/' \
             --include-from="$INCLUDE_FILE" \
@@ -73,12 +56,10 @@ jobs:
           cd /tmp/public
           git config user.name "Gitea CI"
           git config user.email "ci@bausager.org"
-
           git add -A
           if git diff --cached --quiet; then
-            echo "✅ No public-eligible changes to push."
+            echo "No public-eligible changes to push."
           else
-            echo "🚀 Pushing filtered subset to Flux-oss..."
             git commit -m "Sync public subset from Flux (private)"
             git push origin HEAD:main
           fi