diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 93eadb5..98fa89f 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -75,7 +75,7 @@ jobs:
         run: |
           set -eu
 
-          OLD_IMAGE=$(docker inspect --format='{{.Image}}' devops-platform)
+          OLD_IMAGE=$(docker inspect --format='{{.Config.Image}}' devops-platform)
 
           docker pull "$IMAGE"
           docker stop devops-platform
@@ -85,16 +85,10 @@ jobs:
             echo "New container started"
           else
             echo "Failed to start new container; restoring old image"
-            docker run -d \
-              --name devops-platform \
-              --restart unless-stopped \
-              --read-only \
-              --cap-drop=ALL \
-              --security-opt=no-new-privileges:true \
-              --memory=256m \
-              --cpus=0.5 \
-              -p 127.0.0.1:8000:8000 \
-              "$OLD_IMAGE"
+            docker rm -f devops-platform || true
+            if ! IMAGE="$OLD_IMAGE" docker compose up -d --no-build app; then
+              echo "ERROR: rollback failed; manual recovery required"
+            fi
             exit 1
           fi
 
@@ -115,15 +109,8 @@ jobs:
             echo "Health check failed; rolling back"
             docker stop devops-platform || true
             docker rm devops-platform || true
-            docker run -d \
-              --name devops-platform \
-              --restart unless-stopped \
-              --read-only \
-              --cap-drop=ALL \
-              --security-opt=no-new-privileges:true \
-              --memory=256m \
-              --cpus=0.5 \
-              -p 127.0.0.1:8000:8000 \
-              "$OLD_IMAGE"
+            if ! IMAGE="$OLD_IMAGE" docker compose up -d --no-build app; then
+              echo "ERROR: rollback failed; manual recovery required"
+            fi
             exit 1
           fi