diff --git a/.gitea/workflows/main.yaml b/.gitea/workflows/main.yaml
index f09992d..e486d1e 100644
--- a/.gitea/workflows/main.yaml
+++ b/.gitea/workflows/main.yaml
@@ -36,9 +36,29 @@ jobs:
         run: npm run build
       - name: Validate Kubernetes manifest
         run: |
-          if command -v kubectl >/dev/null 2>&1; then
-            kubectl apply --dry-run=client --validate=false -f deploy/havenllo.yaml
-          fi
+          # Offline check only: the runner has no cluster. The real apply happens
+          # in the deploy job using the KUBE_CONFIG secret.
+          python3 - <<'PY'
+          import sys, subprocess
+          try:
+              import yaml
+          except ImportError:
+              subprocess.run(["apk", "add", "--no-cache", "py3-yaml"], check=False)
+              import importlib
+              yaml = importlib.import_module("yaml")
+          kinds = []
+          with open("deploy/havenllo.yaml") as f:
+              for doc in yaml.safe_load_all(f):
+                  if doc is None:
+                      continue
+                  kinds.append(doc.get("kind"))
+          required = ["PersistentVolumeClaim", "Deployment", "Service", "Ingress"]
+          missing = [k for k in required if k not in kinds]
+          if missing:
+              print("MISSING KINDS:", missing)
+              sys.exit(1)
+          print("manifest docs OK:", kinds)
+          PY
   build:
     name: Build and push image
     needs: verify