diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 73973f23..65c4e37d 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -344,18 +344,26 @@ jobs:
           $SUDO apt-get install -y postgresql postgresql-contrib postgresql-16-pgvector redis-server
           # 固定组件/扩展版本输出（随日志归档，作为验收对齐依据）。
           psql --version
-          $SUDO -u postgres psql -tAc "SELECT extversion FROM pg_extension WHERE extname='pgvector'" || true
           redis-server --version
       - name: Start PostgreSQL and Redis
         run: |
           set -euo pipefail
           SUDO=""
           if command -v sudo >/dev/null 2>&1 && [ "$(id -u)" != 0 ]; then SUDO=sudo; fi
+          # 运行器容器以 root 运行且无 sudo：以 postgres 身份执行用 runuser/su
+          # （实测 $SUDO -u 在 root 容器展开成裸 "-u" → exit 127）。
+          pg_as_postgres() {
+            if command -v runuser >/dev/null 2>&1; then runuser -u postgres -- "$@";
+            else su postgres -s /bin/bash -c "$*"; fi
+          }
           $SUDO service postgresql start || $SUDO pg_ctlcluster 16 main start
-          $SUDO -u postgres psql -c "CREATE USER ci_agent PASSWORD 'ci_job_local_only' CREATEDB"
-          $SUDO -u postgres psql -c "CREATE DATABASE agent_test OWNER ci_agent"
-          # 预装 pg_trgm 到 public：与测试辅助的幂等预装一致，锁定的组件契约。
-          $SUDO -u postgres psql -d agent_test -c "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+          # 预装 pg_trgm 到 public：与测试辅助的幂等预装一致，锁定的组件契约；
+          # pgvector 版本一并输出（随日志归档，作为验收对齐依据）。
+          pg_as_postgres psql -tAc "CREATE EXTENSION IF NOT EXISTS pgvector"
+          pg_as_postgres psql -tAc "SELECT extname || '=' || extversion FROM pg_extension WHERE extname IN ('pgvector','pg_trgm')"
+          pg_as_postgres psql -c "CREATE USER ci_agent PASSWORD 'ci_job_local_only' CREATEDB"
+          pg_as_postgres psql -c "CREATE DATABASE agent_test OWNER ci_agent"
+          pg_as_postgres psql -d agent_test -c "CREATE EXTENSION IF NOT EXISTS pg_trgm"
           redis-server --daemonize yes --port 6399 --save '' --appendonly no
           redis-cli -p 6399 ping
       - name: Backend tests against real PostgreSQL and Redis (required, no silent skip)