diff --git a/.forgejo/workflows/build-blumeops.yaml b/.forgejo/workflows/build-blumeops.yaml
index 754f52a..dca745a 100644
--- a/.forgejo/workflows/build-blumeops.yaml
+++ b/.forgejo/workflows/build-blumeops.yaml
@@ -234,7 +234,7 @@ jobs:
           RELEASE_URL="https://forge.ops.eblu.me/eblume/blumeops/releases/download/${VERSION}/${TARBALL}"
 
           echo "Updating $DEPLOYMENT_FILE with new release URL..."
-          sed -i "s|value: \"https://forge.ops.eblu.me/eblume/blumeops/releases/download/[^\"]*\"|value: \"${RELEASE_URL}\"|" "$DEPLOYMENT_FILE"
+          yq -i "(.spec.template.spec.containers[0].env[] | select(.name == \"DOCS_RELEASE_URL\")).value = \"${RELEASE_URL}\"" "$DEPLOYMENT_FILE"
 
           echo "Updated deployment:"
           grep -A1 "DOCS_RELEASE_URL" "$DEPLOYMENT_FILE"
diff --git a/.forgejo/workflows/cv-deploy.yaml b/.forgejo/workflows/cv-deploy.yaml
index 553185c..d2314c9 100644
--- a/.forgejo/workflows/cv-deploy.yaml
+++ b/.forgejo/workflows/cv-deploy.yaml
@@ -68,7 +68,7 @@ jobs:
           RELEASE_URL="https://forge.ops.eblu.me/api/packages/eblume/generic/cv/${VERSION}/${TARBALL}"
 
           echo "Updating $DEPLOYMENT_FILE with CV_RELEASE_URL..."
-          sed -i "s|value: \"https://forge.ops.eblu.me/api/packages/eblume/generic/cv/[^\"]*\"|value: \"${RELEASE_URL}\"|" "$DEPLOYMENT_FILE"
+          yq -i "(.spec.template.spec.containers[0].env[] | select(.name == \"CV_RELEASE_URL\")).value = \"${RELEASE_URL}\"" "$DEPLOYMENT_FILE"
 
           echo "Updated deployment:"
           grep -A1 "CV_RELEASE_URL" "$DEPLOYMENT_FILE"
diff --git a/containers/forgejo-runner/Dockerfile b/containers/forgejo-runner/Dockerfile
index e333401..2adaf42 100644
--- a/containers/forgejo-runner/Dockerfile
+++ b/containers/forgejo-runner/Dockerfile
@@ -4,7 +4,7 @@
 # The host runner daemon creates containers from this image to run workflow steps.
 #
 # Build logic (container images, docs site) runs inside Dagger containers,
-# so this image only needs: git, Docker CLI, Dagger CLI, ArgoCD CLI, uv, and basic tools.
+# so this image only needs: git, Docker CLI, Dagger CLI, ArgoCD CLI, uv, yq, and basic tools.
 #
 # Usage: Configure runner with label like:
 #   docker:docker://registry.ops.eblu.me/blumeops/forgejo-runner:latest
@@ -59,6 +59,13 @@ RUN ARCH="${TARGETARCH:-$(dpkg --print-architecture)}" \
     && rm /tmp/dagger.tar.gz \
     && dagger version
 
+# Install yq (for editing YAML files in workflows)
+RUN ARCH="${TARGETARCH:-$(dpkg --print-architecture)}" \
+    && curl -fsSL -o /usr/local/bin/yq \
+    "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" \
+    && chmod +x /usr/local/bin/yq \
+    && yq --version
+
 # Install flyctl (for Fly.io cache purge after docs deploy)
 RUN curl -L https://fly.io/install.sh | sh \
     && mv /root/.fly/bin/flyctl /usr/local/bin/fly \
diff --git a/docs/changelog.d/feature-yq-in-runner.infra.md b/docs/changelog.d/feature-yq-in-runner.infra.md
new file mode 100644
index 0000000..4856768
--- /dev/null
+++ b/docs/changelog.d/feature-yq-in-runner.infra.md
@@ -0,0 +1 @@
+Add yq to forgejo-runner container and replace sed-based YAML editing in workflows with yq