diff --git a/.gitea/workflows/deploy-dev.yml b/.gitea/workflows/deploy-dev.yml
index d134aa3..3ea631f 100644
--- a/.gitea/workflows/deploy-dev.yml
+++ b/.gitea/workflows/deploy-dev.yml
@@ -192,23 +192,28 @@ jobs:
 
   deploy-dev:
     name: Deploy to Dev
-    runs-on: vps
+    runs-on: nas
+    if: always() && needs.build-image-dev.result == 'success'
     needs: [build-image-dev, backend-tests, frontend-tests]
     env:
       SECRET_KEY: test-secret-key-for-ci-environment-32chars-minimum
+    container:
+      network: gitea_gitea
+      volumes:
+        - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
+        - /volume1/docker/nas-dashboard:/nas-dashboard
 
     steps:
       - name: Checkout repository
         run: |
           if [ ! -d .git ]; then
-            git clone --depth=1 --branch "$GITHUB_REF_NAME" "http://100.78.131.124:3300/${GITHUB_REPOSITORY}.git" .
+            git clone --depth=1 --branch "$GITHUB_REF_NAME" "http://127.0.0.1:3300/${GITHUB_REPOSITORY}.git" .
           fi
 
       - name: Sync runtime compose file
         run: |
-          set -x
-          ssh nasts "mkdir -p /volume1/docker/nas-dashboard"
-          cat dashboard/docker-compose.dev.yml | ssh nasts "cat > /volume1/docker/nas-dashboard/docker-compose.dev.yml"
+          mkdir -p /nas-dashboard
+          cp dashboard/docker-compose.dev.yml /nas-dashboard/docker-compose.dev.yml
 
       - name: Deploy dev
         env:
@@ -216,39 +221,36 @@ jobs:
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
         run: |
           set -x
-          DOCKER="ssh nasts /volume1/@appstore/ContainerManager/usr/bin/docker"
-          COMPOSE="ssh nasts /volume1/@appstore/ContainerManager/usr/bin/docker-compose"
-          NAS_VOL="/volume1/docker/nas-dashboard"
+          export DOCKER_API_VERSION=1.43
 
           # Step 1: Stop existing containers
           echo "=== STEP 1: Down ==="
-          $COMPOSE -f $NAS_VOL/docker-compose.dev.yml -p nas-dashboard-dev down 2>&1 || echo "down ok"
+          docker compose -f /nas-dashboard/docker-compose.dev.yml -p nas-dashboard-dev down 2>&1 || echo "down ok"
 
           # Step 2: Ensure network exists
           echo "=== STEP 2: Network ==="
-          $DOCKER network inspect nas-dashboard_internal >/dev/null 2>&1 || $DOCKER network create nas-dashboard_internal
+          docker network inspect nas-dashboard_internal >/dev/null 2>&1 || docker network create nas-dashboard_internal
 
           # Step 3: Deploy new container
           echo "=== STEP 3: Up ==="
-          ssh nasts "cd $NAS_VOL && GITEA_TOKEN=$GITEA_TOKEN SECRET_KEY=$SECRET_KEY /volume1/@appstore/ContainerManager/usr/bin/docker-compose -f docker-compose.dev.yml -p nas-dashboard-dev up -d --pull never" 2>&1 || echo "up returned $?"
+          cd /nas-dashboard && GITEA_TOKEN=$GITEA_TOKEN SECRET_KEY=$SECRET_KEY docker compose -f docker-compose.dev.yml -p nas-dashboard-dev up -d --pull never 2>&1 || echo "up returned $?"
 
           # Step 4: Verify container exists
           echo "=== STEP 4: Inspect ==="
-          $DOCKER container inspect nas-dashboard-dev >/dev/null 2>&1 && echo "container exists" || { echo "container not found"; exit 1; }
+          docker container inspect nas-dashboard-dev >/dev/null 2>&1 && echo "container exists" || { echo "container not found"; exit 1; }
 
           # Step 5: Connect networks
           echo "=== STEP 5: Network connect ==="
-          $DOCKER network connect nas-dashboard_internal nas-dashboard-dev 2>&1 || echo "already connected"
-          $DOCKER network connect gitea_gitea nas-dashboard-dev 2>&1 || echo "already connected"
+          docker network connect nas-dashboard_internal nas-dashboard-dev 2>&1 || echo "already connected"
+          docker network connect gitea_gitea nas-dashboard-dev 2>&1 || echo "already connected"
 
           echo "=== DEPLOY COMPLETE ==="
 
       - name: Wait for container to be healthy
         run: |
-          DOCKER="ssh nasts /volume1/@appstore/ContainerManager/usr/bin/docker"
           echo "Waiting for container to be healthy..."
           for i in {1..30}; do
-            STATUS=$($DOCKER inspect --format='{{.State.Health.Status}}' nas-dashboard-dev 2>/dev/null || echo "starting")
+            STATUS=$(docker inspect --format='{{.State.Health.Status}}' nas-dashboard-dev 2>/dev/null || echo "starting")
             if [ "$STATUS" = "healthy" ]; then
               echo "✅ Container is healthy"
               break
@@ -256,34 +258,32 @@ jobs:
             echo "Waiting... ($i/30) Status: $STATUS"
             sleep 2
           done
-          STATUS=$($DOCKER inspect --format='{{.State.Health.Status}}' nas-dashboard-dev 2>/dev/null || echo "unknown")
+          STATUS=$(docker inspect --format='{{.State.Health.Status}}' nas-dashboard-dev 2>/dev/null || echo "unknown")
           if [ "$STATUS" != "healthy" ]; then
             echo "❌ Container failed to become healthy: $STATUS"
-            $DOCKER logs nas-dashboard-dev --tail 50
+            docker logs nas-dashboard-dev --tail 50
             exit 1
           fi
 
       - name: Run smoke tests
         run: |
           echo "=== Running smoke tests via docker exec ==="
-          DOCKER="ssh nasts /volume1/@appstore/ContainerManager/usr/bin/docker"
 
           # Test 1: Health check
           echo "1. Testing health endpoint..."
-          printf 'import urllib.request, json\nd = json.loads(urllib.request.urlopen(\"http://localhost:4000/api/health\", timeout=5).read())\nassert d.get(\"status\") == \"ok\"\n' | $DOCKER exec -i nas-dashboard-dev python3 && echo "✅ Health check passed" || { echo "❌ Health check failed"; $DOCKER logs nas-dashboard-dev --tail 50; exit 1; }
+          docker exec nas-dashboard-dev python3 -c "import urllib.request, json; d = json.loads(urllib.request.urlopen('http://localhost:4000/api/health', timeout=5).read()); assert d.get('status') == 'ok'" && echo "✅ Health check passed" || { echo "❌ Health check failed"; docker logs nas-dashboard-dev --tail 50; exit 1; }
 
           # Test 2: Frontend loads
           echo "2. Testing frontend loads..."
-          printf 'import urllib.request\nhtml = urllib.request.urlopen(\"http://localhost:4000/\", timeout=5).read().decode()\nassert \"NAS Dashboard\" in html\n' | $DOCKER exec -i nas-dashboard-dev python3 && echo "✅ Frontend loads" || { echo "❌ Frontend failed to load"; exit 1; }
+          docker exec nas-dashboard-dev python3 -c "import urllib.request; html = urllib.request.urlopen('http://localhost:4000/', timeout=5).read().decode(); assert 'NAS Dashboard' in html" && echo "✅ Frontend loads" || { echo "❌ Frontend failed to load"; exit 1; }
 
           # Test 3: API endpoints require auth
           echo "3. Testing API endpoints require auth..."
-          printf 'import urllib.request, json\ntry:\n  resp = urllib.request.urlopen(\"http://localhost:4000/api/conversations/dates\", timeout=5)\n  data = resp.read().decode()\n  assert \"Not authenticated\" in data or \"detail\" in data\nexcept urllib.error.HTTPError as e:\n  assert e.code in (401, 403)\n' | $DOCKER exec -i nas-dashboard-dev python3 && echo "✅ API requires auth" || { echo "❌ Auth check failed"; exit 1; }
+          docker exec nas-dashboard-dev python3 -c "import urllib.request, json; exec('try:\n  resp = urllib.request.urlopen(\"http://localhost:4000/api/conversations/dates\", timeout=5)\n  data = resp.read().decode()\n  assert \"Not authenticated\" in data or \"detail\" in data\nexcept urllib.error.HTTPError as e:\n  assert e.code in (401, 403)')" && echo "✅ API requires auth" || { echo "❌ Auth check failed"; exit 1; }
 
           # Test 4: Double /api/ prefix bug (non-failing)
           echo "4. Testing for double /api/ prefix bug..."
-          printf 'import urllib.request\ntry:\n  urllib.request.urlopen(\"http://localhost:4000/api/api/conversations/dates\", timeout=5)\n  print(\"WARNING: /api/api/ returned 200\")\nexcept urllib.error.HTTPError as e:\n  assert e.code == 404\n  print(\"OK: /api/api/ returned 404\")\n' | $DOCKER exec -i nas-dashboard-dev python3 && echo "No double /api/ prefix bug" || echo "Warning: Double API prefix"
+          docker exec nas-dashboard-dev python3 -c "import urllib.request; exec('try:\n  urllib.request.urlopen(\"http://localhost:4000/api/api/conversations/dates\", timeout=5)\n  print(\"WARNING: /api/api/ returned 200\")\nexcept urllib.error.HTTPError as e:\n  assert e.code == 404\n  print(\"OK: /api/api/ returned 404\")')" && echo "No double /api/ prefix bug" || echo "Warning: Double API prefix"
 
           echo ""
           echo "=== All smoke tests passed! ==="
-          echo "=== All smoke tests passed! ==="
diff --git a/specs/sprint-09-security-hardening.md b/specs/sprint-09-security-hardening.md
index 03abd4e..ea3f124 100644
--- a/specs/sprint-09-security-hardening.md
+++ b/specs/sprint-09-security-hardening.md
@@ -61,7 +61,7 @@
 - **Verify by:**
   1. Push to dev → deploy step runs on NAS runner, not VPS.
 
-- [ ] S09.5 — Fix dev deploy runner label
+- [x] S09.5 — Fix dev deploy runner label
 
 ## S09.6 — Add `media-ops` to RBAC member defaults
 
@@ -78,11 +78,11 @@
 
 ## Exit criteria
 
-- [ ] No hardcoded SECRET_KEY fallback in any compose file
-- [ ] Audit log gated to admin only
-- [ ] Dev CI gates deploy behind tests
-- [ ] Dev CI deploys on NAS runner
-- [ ] `media-ops` accessible to members
-- [ ] All 267+ backend tests pass
-- [ ] All frontend tests pass
-- [ ] `npm run build` succeeds
+- [x] No hardcoded SECRET_KEY fallback in any compose file
+- [x] Audit log gated to admin only
+- [x] Dev CI gates deploy behind tests
+- [x] Dev CI deploys on NAS runner
+- [x] `media-ops` accessible to members
+- [x] All 267+ backend tests pass
+- [x] All frontend tests pass
+- [x] `npm run build` succeeds