diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 8086775..ca76e3b 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -39,13 +39,10 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
-      - name: Install release build tools
-        run: |
-          set -euo pipefail
-          apt-get update
-          if ! apt-get install -y upx-ucl && ! apt-get install -y upx; then
-            echo "UPX package install failed; release binaries will be uploaded uncompressed." >&2
-          fi
+      - name: Install UPX
+        uses: crazy-max/ghaction-upx@v3
+        with:
+          install-only: true
 
       - name: Validate formatting
         run: test -z "$(gofmt -l .)"
@@ -251,49 +248,25 @@ jobs:
           set -euo pipefail
 
           upx_cmd=""
-          upx_runner=""
           if command -v upx >/dev/null 2>&1; then
             upx_cmd=upx
           elif command -v upx-ucl >/dev/null 2>&1; then
             upx_cmd=upx-ucl
-          elif command -v docker >/dev/null 2>&1; then
-            upx_runner=docker
-          elif command -v podman >/dev/null 2>&1; then
-            upx_runner=podman
           else
-            echo "UPX is not available on PATH and no container runtime is available; continuing without binary compression." >&2
+            echo "UPX is not available on PATH after install step; continuing without binary compression." >&2
           fi
 
           mkdir -p dist
 
-          compress_with_upx() {
-            local file="$1"
-
-            if [[ -n "${upx_cmd}" ]]; then
-              "${upx_cmd}" --best --lzma "${file}"
-              return
-            fi
-
-            if [[ "${upx_runner}" == "docker" ]]; then
-              docker run --rm -v "$PWD/dist:/work" ghcr.io/upx/upx:4.2.4 --best --lzma "/work/$(basename "${file}")"
-              return
-            fi
-
-            if [[ "${upx_runner}" == "podman" ]]; then
-              podman run --rm -v "$PWD/dist:/work:Z" ghcr.io/upx/upx:4.2.4 --best --lzma "/work/$(basename "${file}")"
-              return
-            fi
-
-            return 0
-          }
-
           for target in linux/amd64 linux/arm64; do
             os="${target%/*}"
             arch="${target#*/}"
 
             bin="vociferate_${RELEASE_VERSION}_${os}_${arch}"
             GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "dist/${bin}" ./cmd/vociferate
-            compress_with_upx "dist/${bin}"
+            if [[ -n "${upx_cmd}" ]]; then
+              "${upx_cmd}" --best --lzma "dist/${bin}"
+            fi
           done
 
           (
@@ -373,7 +346,7 @@ jobs:
               echo "- Tag: ${TAG_NAME}"
               echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
               echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
-              echo "- Release binaries use local UPX when available, otherwise containerized UPX (Docker/Podman), otherwise uncompressed upload."
+              echo "- Release binaries are compressed with UPX from crazy-max/ghaction-upx@v3 when available, otherwise uploaded uncompressed."
             } >> "$SUMMARY_FILE"
           else
             {
diff --git a/.gitea/workflows/update-release.yml b/.gitea/workflows/update-release.yml
index 1ed40ad..bea07d8 100644
--- a/.gitea/workflows/update-release.yml
+++ b/.gitea/workflows/update-release.yml
@@ -122,13 +122,10 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
-      - name: Install release build tools
-        run: |
-          set -euo pipefail
-          apt-get update
-          if ! apt-get install -y upx-ucl && ! apt-get install -y upx; then
-            echo "UPX package install failed; release binaries will be uploaded uncompressed." >&2
-          fi
+      - name: Install UPX
+        uses: crazy-max/ghaction-upx@v3
+        with:
+          install-only: true
 
       - name: Preflight release API access
         env:
@@ -173,49 +170,25 @@ jobs:
           set -euo pipefail
 
           upx_cmd=""
-          upx_runner=""
           if command -v upx >/dev/null 2>&1; then
             upx_cmd=upx
           elif command -v upx-ucl >/dev/null 2>&1; then
             upx_cmd=upx-ucl
-          elif command -v docker >/dev/null 2>&1; then
-            upx_runner=docker
-          elif command -v podman >/dev/null 2>&1; then
-            upx_runner=podman
           else
-            echo "UPX is not available on PATH and no container runtime is available; continuing without binary compression." >&2
+            echo "UPX is not available on PATH after install step; continuing without binary compression." >&2
           fi
 
           mkdir -p dist
 
-          compress_with_upx() {
-            local file="$1"
-
-            if [[ -n "${upx_cmd}" ]]; then
-              "${upx_cmd}" --best --lzma "${file}"
-              return
-            fi
-
-            if [[ "${upx_runner}" == "docker" ]]; then
-              docker run --rm -v "$PWD/dist:/work" ghcr.io/upx/upx:4.2.4 --best --lzma "/work/$(basename "${file}")"
-              return
-            fi
-
-            if [[ "${upx_runner}" == "podman" ]]; then
-              podman run --rm -v "$PWD/dist:/work:Z" ghcr.io/upx/upx:4.2.4 --best --lzma "/work/$(basename "${file}")"
-              return
-            fi
-
-            return 0
-          }
-
           for target in linux/amd64 linux/arm64; do
             os="${target%/*}"
             arch="${target#*/}"
 
             bin="vociferate_${RELEASE_VERSION}_${os}_${arch}"
             GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "dist/${bin}" ./cmd/vociferate
-            compress_with_upx "dist/${bin}"
+            if [[ -n "${upx_cmd}" ]]; then
+              "${upx_cmd}" --best --lzma "dist/${bin}"
+            fi
           done
 
           (
@@ -295,7 +268,7 @@ jobs:
               echo "- Tag: ${TAG_NAME}"
               echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
               echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
-              echo "- Release binaries use local UPX when available, otherwise containerized UPX (Docker/Podman), otherwise uncompressed upload."
+              echo "- Release binaries are compressed with UPX from crazy-max/ghaction-upx@v3 when available, otherwise uploaded uncompressed."
             } >> "$SUMMARY_FILE"
           else
             {