diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index a1b7936..f40ef09 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -10,6 +10,8 @@
 #   DEPLOY_PORT          SSH port, default 22
 #   DEPLOY_KNOWN_HOSTS   optional output of `ssh-keyscan <host>`; otherwise the host key is scanned on each run
 # Repository settings → Actions → Variables (optional):
+#   NPM_REGISTRY         npm mirror used by the runner and the server's Docker build when
+#                        registry.npmjs.org is unreachable, e.g. from servers in Iran
 #   DEPLOY_PATH          directory on the server, default vending-machine-game (in the user's home)
 #   SITE_ADDRESS         domains served with HTTPS, default "robotmarkets.ir, www.robotmarkets.ir"
 #   HEALTH_URL           URL checked after deploy, e.g. https://robotmarkets.ir/
@@ -26,9 +28,16 @@ concurrency:
   group: ci-cd-${{ github.ref }}
   cancel-in-progress: false
 
+# Fail within minutes instead of hanging when the registry is slow or blocked.
+env:
+  NPM_CONFIG_REGISTRY: ${{ vars.NPM_REGISTRY || 'https://registry.npmjs.org/' }}
+  NPM_CONFIG_FETCH_RETRIES: '3'
+  NPM_CONFIG_FETCH_TIMEOUT: '60000'
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     container:
       image: node:22-bookworm
     steps:
@@ -44,6 +53,7 @@ jobs:
     needs: test
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     container:
       image: node:22-bookworm
     env:
@@ -77,7 +87,7 @@ jobs:
           # Ship the checked-out sources (no git history) and rebuild/restart the container there.
           tar czf - --exclude=./.git --exclude=./node_modules --exclude=./dist . \
             | ssh -i ~/.ssh/deploy_key -p "$port" "$target" \
-              "mkdir -p '$dir' && tar xzf - -C '$dir' && cd '$dir' && SITE_ADDRESS='$site' docker compose up -d --build --remove-orphans && docker image prune -f"
+              "mkdir -p '$dir' && tar xzf - -C '$dir' && cd '$dir' && SITE_ADDRESS='$site' NPM_REGISTRY='$NPM_CONFIG_REGISTRY' docker compose up -d --build --remove-orphans && docker image prune -f"
 
       - name: Check the site
         if: env.HEALTH_URL != '' && env.DEPLOY_HOST != ''
diff --git a/Dockerfile b/Dockerfile
index 89082be..b913e05 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,10 @@
 # Stage 1: run the tests and build the static game with Vite.
 FROM node:22-alpine AS build
 WORKDIR /app
+# Override with a reachable mirror where registry.npmjs.org is blocked (docker compose passes NPM_REGISTRY).
+ARG NPM_REGISTRY=https://registry.npmjs.org/
 COPY package.json package-lock.json ./
-RUN npm ci --no-audit --no-fund
+RUN npm ci --no-audit --no-fund --registry="$NPM_REGISTRY" --fetch-retries=3 --fetch-timeout=60000
 COPY . .
 RUN node --test tests/*.test.js && npm run build
 
diff --git a/README.md b/README.md
index 3daf05b..797a606 100644
--- a/README.md
+++ b/README.md
@@ -130,8 +130,9 @@ docker compose logs -f
    - `DEPLOY_PATH`: پوشهٔ روی سرور
    - `SITE_ADDRESS`: دامنه‌ها
    - `HEALTH_URL`: مثلاً `https://robotmarkets.ir/`، تا بعد از انتشار بالا آمدن سایت چک شود
+   - `NPM_REGISTRY`: اگر runner یا سرور به `registry.npmjs.org` دسترسی ندارد (معمول در سرورهای ایران)، آدرس یک mirror در دسترس npm را اینجا بگذارید. همین مقدار برای build روی سرور هم استفاده می‌شود.
 
-تا وقتی `DEPLOY_HOST` تعریف نشده، مرحلهٔ انتشار رد می‌شود و فقط تست و build اجرا می‌شوند.
+تا وقتی `DEPLOY_HOST` تعریف نشده، مرحلهٔ انتشار رد می‌شود و فقط تست و build اجرا می‌شوند. هر مرحله محدودیت زمانی دارد (تست ۱۵ دقیقه، انتشار ۳۰ دقیقه) تا runner هیچ‌وقت بی‌پایان معطل نماند.
 
 ## ساخت دوبارهٔ دادهٔ نقشه
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 9ca0588..69793b9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,9 @@
 services:
   game:
-    build: .
+    build:
+      context: .
+      args:
+        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org/}
     image: robot-market-game:latest
     restart: unless-stopped
     ports: