diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index d4488ae..953b09c 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -225,13 +225,13 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
           CACHE_REF_WEB: ""
-          # buildx bake: context ../.. (корень репо) — на доверенном CI отключаем fs entitlement gate
           BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl go-images --push
 
   # ---------------------------------------------------------------------------
   # Docker: Web (evobgp-web, evobgp-web-all) — один npm ci (кэш) + два nginx-тега.
@@ -274,7 +274,8 @@ jobs:
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl web-images --push
 
   # ---------------------------------------------------------------------------
   # Docker: BIRD2 (evobgp-bird2).
@@ -318,4 +319,5 @@ jobs:
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl evobgp-bird2 --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl evobgp-bird2 --push
diff --git a/deploy/docker/README.md b/deploy/docker/README.md
index e70c57b..d280a41 100644
--- a/deploy/docker/README.md
+++ b/deploy/docker/README.md
@@ -28,11 +28,11 @@ export REGISTRY=git.shts.su/<owner>
 export IMAGE_TAG=latest
 export SHORT_SHA=$(git rev-parse --short HEAD)
 sh write-bake-override.sh
-docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images
-docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl -f docker-bake.override.hcl go-images
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl -f docker-bake.override.hcl web-images
 ```
 
-**CI:** на runner без `buildx bake --var` скрипт `write-bake-override.sh` генерирует `docker-bake.override.hcl`. В workflow задано `BUILDX_BAKE_ENTITLEMENTS_FS=0`, чтобы bake мог читать `context = "../.."` (корень репозитория). Локально при той же ошибке: `docker buildx bake --allow=fs.read=* …` или `export BUILDX_BAKE_ENTITLEMENTS_FS=0`.
+В `docker-bake.hcl`: `context = "../.."` (корень репо), `dockerfile = "deploy/docker/…"` (путь от корня репо). **CI:** `write-bake-override.sh` + `--allow=fs.read=$GITHUB_WORKSPACE` в `.gitea/workflows/ci.yaml`.
 
 Один образ (legacy):
 
diff --git a/deploy/docker/docker-bake.hcl b/deploy/docker/docker-bake.hcl
index 9245b3a..48c6238 100644
--- a/deploy/docker/docker-bake.hcl
+++ b/deploy/docker/docker-bake.hcl
@@ -1,4 +1,6 @@
-# Единая сборка образов EvoBGP для CI (buildx bake из deploy/docker/).
+# Единая сборка образов EvoBGP (buildx bake: -f deploy/docker/docker-bake.hcl).
+# context = "../.." — корень репозитория (относительно этого файла).
+# dockerfile — путь от корня репозитория (относительно context).
 # Переменные: REGISTRY, IMAGE_TAG, CACHE_REF_GO, CACHE_REF_WEB
 
 variable "REGISTRY" {
@@ -70,7 +72,7 @@ group "web-images" {
 
 target "go-deps" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "deps"
   platforms  = ["linux/amd64"]
   cache-from = go-cache-from()
@@ -79,7 +81,7 @@ target "go-deps" {
 
 target "go-build-all" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "build-all"
   platforms  = ["linux/amd64"]
   contexts = {
@@ -91,7 +93,7 @@ target "go-build-all" {
 
 target "go-birdc" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "birdc"
   platforms  = ["linux/amd64"]
   cache-from = go-cache-from()
@@ -100,7 +102,7 @@ target "go-birdc" {
 
 target "_go-runtime" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "runtime"
   platforms  = ["linux/amd64"]
   contexts = {
@@ -112,7 +114,7 @@ target "_go-runtime" {
 
 target "_go-runtime-birdc" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "runtime-birdc"
   platforms  = ["linux/amd64"]
   contexts = {
@@ -179,7 +181,7 @@ target "evobgp-node" {
 
 target "evobgp-agent" {
   context    = "../.."
-  dockerfile = "evobgp-agent/Dockerfile"
+  dockerfile = "deploy/docker/evobgp-agent/Dockerfile"
   platforms  = ["linux/amd64"]
   contexts = {
     build-all = "target:go-build-all"
@@ -193,7 +195,7 @@ target "evobgp-agent" {
 
 target "web-deps" {
   context    = "../.."
-  dockerfile = "evobgp-web/Dockerfile"
+  dockerfile = "deploy/docker/evobgp-web/Dockerfile"
   target     = "deps"
   platforms  = ["linux/amd64"]
   cache-from = web-cache-from()
@@ -202,7 +204,7 @@ target "web-deps" {
 
 target "evobgp-web" {
   context    = "../.."
-  dockerfile = "evobgp-web/Dockerfile"
+  dockerfile = "deploy/docker/evobgp-web/Dockerfile"
   platforms  = ["linux/amd64"]
   contexts = {
     deps = "target:web-deps"
@@ -221,7 +223,7 @@ target "evobgp-web-all" {
 
 target "evobgp-bird2" {
   context    = "../.."
-  dockerfile = "bird2/Dockerfile"
+  dockerfile = "deploy/docker/bird2/Dockerfile"
   platforms  = ["linux/amd64"]
   tags       = image-tags("evobgp-bird2")
 }