diff --git a/.gitea/actions/local-ci-build/action.yml b/.gitea/actions/local-ci-build/action.yml
index 6b28684..ae1b741 100644
--- a/.gitea/actions/local-ci-build/action.yml
+++ b/.gitea/actions/local-ci-build/action.yml
@@ -150,7 +150,7 @@ inputs:
     description: >
       JSON object of extra environment variables to inject into the build VM
       guest before the build command runs. Use for signing keys and secrets.
-      Example: '{"SIGN_PASS":"${{ secrets.SIGN_PASS }}","GPG_KEY_ID":"0xABCD1234"}'
+      Example: '{"SIGN_PASS":"<secrets.SIGN_PASS>","GPG_KEY_ID":"0xABCD1234"}'
       Values are passed via ExtraGuestEnv hashtable in Invoke-CIJob.ps1 and
       are never echoed to the log.
     required: false
@@ -236,9 +236,12 @@ runs:
         $ErrorActionPreference = 'Stop'
 
         # Resolve Python interpreter from venv (Phase A4 — Python orchestrator).
-        # Override with CI_VENV_PYTHON env var; default matches Setup-Host.ps1 layout.
+        # Override with CI_VENV_PYTHON env var; OS-specific defaults otherwise.
         $venvPython = $env:CI_VENV_PYTHON
-        if (-not $venvPython) { $venvPython = 'F:\CI\python\venv\Scripts\python.exe' }
+        if (-not $venvPython) {
+            if ($IsLinux) { $venvPython = '/opt/ci/venv/bin/python' }
+            else           { $venvPython = 'F:\CI\python\venv\Scripts\python.exe' }
+        }
         if (-not (Test-Path -LiteralPath $venvPython)) {
             throw "Python interpreter not found at '$venvPython'. Set CI_VENV_PYTHON or run Setup-Host.ps1."
         }
@@ -246,7 +249,8 @@ runs:
         # Build job ID — append suffix when provided (matrix disambiguation)
         $jobId = '${{ github.run_id }}-${{ github.run_attempt }}'
         if ($env:INPUT_JOB_ID_SUFFIX) { $jobId = "$jobId-$($env:INPUT_JOB_ID_SUFFIX)" }
-        $artifactPath = "F:\CI\Artifacts\$jobId"
+        if ($IsLinux) { $artifactPath = "/var/lib/ci/artifacts/$jobId" }
+        else           { $artifactPath = "F:\CI\Artifacts\$jobId" }
 
         # Resolve artifact name: caller-supplied or default to build-{run_id}-{sha}
         if ($env:INPUT_ARTIFACT_NAME) {