diff --git a/proxmox/fetch-release.sh b/proxmox/fetch-release.sh
index 588e724..4489025 100644
--- a/proxmox/fetch-release.sh
+++ b/proxmox/fetch-release.sh
@@ -4,6 +4,7 @@
 #   GITEA_URL, GITEA_OWNER, GITEA_REPO, RELEASE_TAG (latest|v1.2.3)
 #   API_DIR (default /opt/myoffice/api)
 #   RELEASE_ASSET_URL  — optional direct override (skips API resolve)
+#   LOCAL_RELEASE_TAR  — optional local .tar.gz (skips download; used when host pushes asset into CT)
 #   GITEA_TOKEN        — optional for private release downloads
 
 set -euo pipefail
@@ -14,6 +15,7 @@ GITEA_OWNER="${GITEA_OWNER:-}"
 GITEA_REPO="${GITEA_REPO:-myoffice_public}"
 RELEASE_TAG="${RELEASE_TAG:-latest}"
 RELEASE_ASSET_URL="${RELEASE_ASSET_URL:-}"
+LOCAL_RELEASE_TAR="${LOCAL_RELEASE_TAR:-}"
 ASSET_NAME="${ASSET_NAME:-myoffice-publish.tar.gz}"
 GITEA_TOKEN="${GITEA_TOKEN:-}"
 
@@ -69,22 +71,26 @@ resolve_asset_url() {
   echo "$browser_url"
 }
 
-download_and_extract() {
-  local url tar_path staging
+# Download release asset to a file path (usable on Proxmox host).
+download_asset_to() {
+  local dest="$1"
+  local url
   url=$(resolve_asset_url)
   msg "Downloading release asset: $url"
+  curl_auth -o "$dest" "$url"
+  msg "Saved $dest"
+}
+
+extract_tar_to_api() {
+  local tar_path="$1"
+  local staging prod shared_prod prod_bak="" shared_bak="" top_count top_dir only
 
   mkdir -p "$API_DIR"
-  tar_path="/tmp/${ASSET_NAME}"
-  curl_auth -o "$tar_path" "$url"
-
   staging=$(mktemp -d /tmp/myoffice-extract.XXXXXX)
   tar -xzf "$tar_path" -C "$staging"
-  rm -f "$tar_path"
 
-  local prod="${API_DIR}/appsettings.Production.json"
-  local shared_prod="${API_DIR}/appsettings.shared.Production.json"
-  local prod_bak="" shared_bak=""
+  prod="${API_DIR}/appsettings.Production.json"
+  shared_prod="${API_DIR}/appsettings.shared.Production.json"
   if [[ -f "$prod" ]]; then
     prod_bak=$(mktemp)
     cp -a "$prod" "$prod_bak"
@@ -94,11 +100,9 @@ download_and_extract() {
     cp -a "$shared_prod" "$shared_bak"
   fi
 
-  local top_count top_dir
   top_count=$(find "$staging" -mindepth 1 -maxdepth 1 | wc -l)
   top_dir=""
   if [[ "$top_count" -eq 1 ]]; then
-    local only
     only=$(find "$staging" -mindepth 1 -maxdepth 1 | head -1)
     if [[ -d "$only" ]]; then
       top_dir="$only"
@@ -132,6 +136,22 @@ download_and_extract() {
   msg "App extracted to ${API_DIR}"
 }
 
+download_and_extract() {
+  local tar_path
+
+  if [[ -n "$LOCAL_RELEASE_TAR" && -f "$LOCAL_RELEASE_TAR" ]]; then
+    msg "Using local release tar: $LOCAL_RELEASE_TAR"
+    tar_path="$LOCAL_RELEASE_TAR"
+    extract_tar_to_api "$tar_path"
+    return 0
+  fi
+
+  tar_path="/tmp/${ASSET_NAME}"
+  download_asset_to "$tar_path"
+  extract_tar_to_api "$tar_path"
+  rm -f "$tar_path"
+}
+
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
   download_and_extract
 fi
diff --git a/proxmox/install-in-ct.sh b/proxmox/install-in-ct.sh
index 89a8399..e17ed87 100644
--- a/proxmox/install-in-ct.sh
+++ b/proxmox/install-in-ct.sh
@@ -29,10 +29,11 @@ msg() { echo -e " ==> $*"; }
 
 as_postgres() {
   # Script runs as root in CT; sudo is not installed.
+  # cd away from /root — postgres cannot access it (harmless but noisy otherwise).
   if command -v runuser >/dev/null 2>&1; then
-    runuser -u postgres -- "$@"
+    (cd /tmp && runuser -u postgres -- "$@")
   else
-    su -s /bin/bash postgres -c "$*"
+    (cd /tmp && su -s /bin/bash postgres -c "$(printf '%q ' "$@")")
   fi
 }
 
diff --git a/proxmox/myoffice.sh b/proxmox/myoffice.sh
index 0320897..9a3e4fa 100644
--- a/proxmox/myoffice.sh
+++ b/proxmox/myoffice.sh
@@ -449,6 +449,32 @@ push_install_assets() {
   pct exec "$CTID" -- chmod +x "${dest_dir}/install-in-ct.sh" "${dest_dir}/fetch-release.sh" "${dest_dir}/update.sh"
 }
 
+# CT often cannot reach Gitea (isolated LAN). Download release on the Proxmox host, then push in.
+download_release_on_host() {
+  local host_tar="/tmp/myoffice-publish.tar.gz"
+  local fetch_src
+
+  msg_info "Downloading release on Proxmox host..."
+  if [[ -n "${SCRIPT_DIR}" && -f "${SCRIPT_DIR}/fetch-release.sh" ]]; then
+    fetch_src="${SCRIPT_DIR}/fetch-release.sh"
+  else
+    curl -fsSL "${REPO_RAW_BASE}/proxmox/fetch-release.sh" -o /tmp/fetch-release.sh
+    fetch_src=/tmp/fetch-release.sh
+  fi
+
+  # shellcheck disable=SC1090
+  GITEA_URL="$GITEA_URL" \
+  GITEA_OWNER="$GITEA_OWNER" \
+  GITEA_REPO="$GITEA_REPO" \
+  RELEASE_TAG="$RELEASE_TAG" \
+  RELEASE_ASSET_URL="$RELEASE_ASSET_URL" \
+  GITEA_TOKEN="$GITEA_TOKEN" \
+    bash -c 'source "'"$fetch_src"'" && download_asset_to "'"$host_tar"'"'
+
+  pct push "$CTID" "$host_tar" "/tmp/myoffice-publish.tar.gz"
+  msg_ok "Release pushed into CT"
+}
+
 run_ct_install() {
   if [[ -z "${PUBLIC_URL}" ]]; then
     PUBLIC_URL="http://${CT_IP}:${API_PORT}"
@@ -457,6 +483,7 @@ run_ct_install() {
     msg_error "Set GITEA_URL + GITEA_OWNER (and GITEA_REPO), or RELEASE_ASSET_URL, before install."
     exit 1
   fi
+  download_release_on_host
   msg_info "Installing PostgreSQL + ASP.NET runtime + Gitea release..."
   pct exec "$CTID" -- env \
     REPO_RAW_BASE="$REPO_RAW_BASE" \
@@ -470,6 +497,7 @@ run_ct_install() {
     RELEASE_TAG="$RELEASE_TAG" \
     RELEASE_ASSET_URL="$RELEASE_ASSET_URL" \
     GITEA_TOKEN="$GITEA_TOKEN" \
+    LOCAL_RELEASE_TAR="/tmp/myoffice-publish.tar.gz" \
     bash /tmp/myoffice-proxmox/install-in-ct.sh
   msg_ok "Stack installed"
 }