diff --git a/.woodpecker/db.yml b/.woodpecker/db.yml
index 2a88b67..fef1dbe 100644
--- a/.woodpecker/db.yml
+++ b/.woodpecker/db.yml
@@ -23,7 +23,7 @@ steps:
       VAULT_SECRET_ID: { from_secret: VAULT_SECRET_ID }
     commands:
       - set -euo pipefail
-      - apk add --no-cache bash coreutils openssh-keygen curl sed
+      - apk add --no-cache bash coreutils openssh-keygen curl sed python3
       - mkdir -p secrets
       # Retrieve SSH private key for deploy (existing helper)
       - ./ci/vlt kv_to_file kv ops/deploy/ssh_key private_b64 secrets/SSH_KEY.b64 600