diff --git a/.gitea/workflows/web-daily.yml b/.gitea/workflows/web-daily.yml
index 55d3d97..9ee8ba9 100644
--- a/.gitea/workflows/web-daily.yml
+++ b/.gitea/workflows/web-daily.yml
@@ -38,9 +38,16 @@ jobs:
           PYTHON=python3
           command -v python3 >/dev/null || PYTHON=python
           command -v node >/dev/null || { echo "node/npx required for wrangler deploy"; exit 1; }
-          # Job-local venv: Homebrew/PEP 668 blocks system pip install.
-          "$PYTHON" -m venv .venv
-          .venv/bin/pip install -q -r web/requirements.txt
+          # Prefer job-local venv (PEP 668). Some runners lack ensurepip/python3-venv.
+          rm -rf .venv
+          if "$PYTHON" -m venv .venv; then
+            .venv/bin/pip install -q -r web/requirements.txt
+            echo "CLIMPEROR_PY=${PWD}/.venv/bin/python" >> "$GITHUB_ENV"
+          else
+            echo "venv unavailable; pip --break-system-packages"
+            "$PYTHON" -m pip install -q --break-system-packages -r web/requirements.txt
+            echo "CLIMPEROR_PY=${PYTHON}" >> "$GITHUB_ENV"
+          fi
 
       - name: Refresh daily tier
         env:
@@ -53,7 +60,7 @@ jobs:
           OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
         run: |
           set -e
-          .venv/bin/python web/refresh_web.py --tier daily
+          "${CLIMPEROR_PY}" web/refresh_web.py --tier daily
 
       - name: Save refresh summary
         if: always()
diff --git a/.gitea/workflows/web-patch.yml b/.gitea/workflows/web-patch.yml
index a534872..3e6ae39 100644
--- a/.gitea/workflows/web-patch.yml
+++ b/.gitea/workflows/web-patch.yml
@@ -37,9 +37,16 @@ jobs:
           PYTHON=python3
           command -v python3 >/dev/null || PYTHON=python
           command -v node >/dev/null || { echo "node/npx required for wrangler deploy"; exit 1; }
-          # Job-local venv: Homebrew/PEP 668 blocks system pip install.
-          "$PYTHON" -m venv .venv
-          .venv/bin/pip install -q -r web/requirements.txt
+          # Prefer job-local venv (PEP 668). Some runners lack ensurepip/python3-venv.
+          rm -rf .venv
+          if "$PYTHON" -m venv .venv; then
+            .venv/bin/pip install -q -r web/requirements.txt
+            echo "CLIMPEROR_PY=${PWD}/.venv/bin/python" >> "$GITHUB_ENV"
+          else
+            echo "venv unavailable; pip --break-system-packages"
+            "$PYTHON" -m pip install -q --break-system-packages -r web/requirements.txt
+            echo "CLIMPEROR_PY=${PYTHON}" >> "$GITHUB_ENV"
+          fi
 
       - name: Refresh patch tier
         env:
@@ -51,7 +58,7 @@ jobs:
           OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
         run: |
           set -e
-          .venv/bin/python web/refresh_web.py --tier patch
+          "${CLIMPEROR_PY}" web/refresh_web.py --tier patch
 
       - name: Save refresh summary
         if: always()
diff --git a/.gitea/workflows/web-weekly.yml b/.gitea/workflows/web-weekly.yml
index cf0ac52..0e4bd0d 100644
--- a/.gitea/workflows/web-weekly.yml
+++ b/.gitea/workflows/web-weekly.yml
@@ -36,9 +36,16 @@ jobs:
           PYTHON=python3
           command -v python3 >/dev/null || PYTHON=python
           command -v node >/dev/null || { echo "node/npx required for wrangler deploy"; exit 1; }
-          # Job-local venv: Homebrew/PEP 668 blocks system pip install.
-          "$PYTHON" -m venv .venv
-          .venv/bin/pip install -q -r web/requirements.txt
+          # Prefer job-local venv (PEP 668). Some runners lack ensurepip/python3-venv.
+          rm -rf .venv
+          if "$PYTHON" -m venv .venv; then
+            .venv/bin/pip install -q -r web/requirements.txt
+            echo "CLIMPEROR_PY=${PWD}/.venv/bin/python" >> "$GITHUB_ENV"
+          else
+            echo "venv unavailable; pip --break-system-packages"
+            "$PYTHON" -m pip install -q --break-system-packages -r web/requirements.txt
+            echo "CLIMPEROR_PY=${PYTHON}" >> "$GITHUB_ENV"
+          fi
 
       - name: Refresh weekly tier
         env:
@@ -51,7 +58,7 @@ jobs:
           OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
         run: |
           set -e
-          .venv/bin/python web/refresh_web.py --tier weekly
+          "${CLIMPEROR_PY}" web/refresh_web.py --tier weekly
 
       - name: Save refresh summary
         if: always()