diff --git a/.gitea/workflows/rag-ingest.yaml b/.gitea/workflows/rag-ingest.yaml
index 4ad92e8..1de7dac 100644
--- a/.gitea/workflows/rag-ingest.yaml
+++ b/.gitea/workflows/rag-ingest.yaml
@@ -30,16 +30,6 @@ jobs:
         run: |
           git clone --depth 1 --branch main ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
 
-      - name: Join breakpilot-network
-        run: |
-          # Runner-Container ans breakpilot-network anhaengen,
-          # damit bp-core-rag-service erreichbar ist
-          CONTAINER_ID=$(cat /etc/hostname)
-          echo "Runner container: $CONTAINER_ID"
-          docker network connect breakpilot-network "$CONTAINER_ID" 2>/dev/null \
-            && echo "Verbunden mit breakpilot-network" \
-            || echo "WARNUNG: breakpilot-network nicht verfuegbar"
-
       - name: Run Ingestion
         run: |
           set -euo pipefail
@@ -48,32 +38,35 @@ jobs:
           echo "=== RAG Ingestion: Phase ${PHASE} ==="
           echo ""
 
-          export WORK_DIR="/tmp/rag-ingestion"
-          export QDRANT_URL="https://qdrant-dev.breakpilot.ai"
-          export RAG_URL="http://bp-core-rag-service:8097/api/v1/documents/upload"
-          export SDK_URL="http://bp-compliance-ai-sdk:8090"
-
-          mkdir -p "$WORK_DIR"/{pdfs,repos,texts}
-
-          echo "RAG API:  $RAG_URL"
-          echo "Qdrant:   $QDRANT_URL"
-          echo "Work Dir: $WORK_DIR"
+          # Debug: Netzwerke und laufende Container anzeigen
+          echo "--- Docker Networks ---"
+          docker network ls 2>/dev/null || echo "docker network ls fehlgeschlagen"
+          echo ""
+          echo "--- RAG-relevante Container ---"
+          docker ps --filter name=rag --format "{{.Names}} {{.Status}}" 2>/dev/null || true
+          docker ps --filter name=bp-core --format "{{.Names}} {{.Status}}" 2>/dev/null || true
           echo ""
 
-          # Health Check: RAG ueber Container-Netzwerk erreichbar?
-          if ! curl -sf "$RAG_URL" -X POST -o /dev/null 2>/dev/null; then
-            echo "FEHLER: RAG API nicht erreichbar unter $RAG_URL"
-            echo "Stelle sicher, dass bp-core-rag-service laeuft und breakpilot-network existiert."
-            exit 1
-          fi
-          echo "RAG API erreichbar."
-          echo ""
-
-          if [ "$PHASE" = "all" ]; then
-            bash scripts/ingest-legal-corpus.sh
-          else
-            bash scripts/ingest-legal-corpus.sh --only "$PHASE"
-          fi
+          # Ingestion in einem Container auf breakpilot-network ausfuehren.
+          # Der Runner hat Docker-Socket-Zugriff und kann Container spawnen.
+          docker run --rm \
+            --network breakpilot-network \
+            -v "$(pwd)/scripts:/workspace/scripts:ro" \
+            -e "WORK_DIR=/tmp/rag-ingestion" \
+            -e "RAG_URL=http://bp-core-rag-service:8097/api/v1/documents/upload" \
+            -e "QDRANT_URL=https://qdrant-dev.breakpilot.ai" \
+            -e "SDK_URL=http://bp-compliance-ai-sdk:8090" \
+            alpine:3.19 \
+            sh -c "
+              apk add --no-cache curl bash coreutils > /dev/null 2>&1
+              mkdir -p /tmp/rag-ingestion/{pdfs,repos,texts}
+              cd /workspace
+              if [ '$PHASE' = 'all' ]; then
+                bash scripts/ingest-legal-corpus.sh
+              else
+                bash scripts/ingest-legal-corpus.sh --only '$PHASE'
+              fi
+            "
 
           echo ""
           echo "=== Ingestion abgeschlossen ==="