diff --git a/.gitea/workflows/nas-compose-deploy.yml b/.gitea/workflows/nas-compose-deploy.yml
index 0de1b0d..ce03082 100644
--- a/.gitea/workflows/nas-compose-deploy.yml
+++ b/.gitea/workflows/nas-compose-deploy.yml
@@ -159,9 +159,11 @@ jobs:
 
           remote="${NAS_USER}@${NAS_HOST}"
           ssh_opts="-p ${NAS_PORT} -o BatchMode=no -o StrictHostKeyChecking=yes"
+          sudo_password_b64="$(printf '%s' "${NAS_SSH_PASSWORD}" | base64 | tr -d '\n')"
 
-          SSHPASS="${NAS_SSH_PASSWORD}" sshpass -e ssh ${ssh_opts} "${remote}" \
-            "DEPLOY_BASE='${DEPLOY_BASE}' RELEASE_ID='${RELEASE_ID}' IMAGE_TAG='${IMAGE_TAG}' KEEP_RELEASES='${KEEP_RELEASES}' sh -se" <<'REMOTE_SCRIPT'
+          {
+            printf 'SUDO_PASSWORD_B64=%s\n' "${sudo_password_b64}"
+            cat <<'REMOTE_SCRIPT'
           set -eu
 
           release_dir="${DEPLOY_BASE}/releases/${RELEASE_ID}"
@@ -180,21 +182,46 @@ jobs:
             echo "Created ${shared_dir}/.env from .env.example. Edit it on the NAS before production traffic if secrets are still placeholders."
           fi
 
-          docker compose version
+          SUDO_PASSWORD="$(printf '%s' "${SUDO_PASSWORD_B64}" | base64 -d 2>/dev/null || true)"
+          unset SUDO_PASSWORD_B64
 
-          IMAGE_TAG="${IMAGE_TAG}" DOCKER_BUILDKIT=1 docker compose \
+          docker_cmd() {
+            if [ "${DOCKER_MODE}" = "sudo" ]; then
+              printf '%s\n' "${SUDO_PASSWORD}" | sudo -S -p "" docker "$@"
+            else
+              docker "$@"
+            fi
+          }
+
+          compose_cmd() {
+            docker_cmd compose "$@"
+          }
+
+          if docker info >/dev/null 2>&1; then
+            DOCKER_MODE="direct"
+          elif command -v sudo >/dev/null 2>&1 && [ -n "${SUDO_PASSWORD}" ] && printf '%s\n' "${SUDO_PASSWORD}" | sudo -S -p "" docker info >/dev/null 2>&1; then
+            DOCKER_MODE="sudo"
+          else
+            echo "Cannot access Docker daemon as $(id -un). Add the user to the docker group or allow sudo docker."
+            exit 1
+          fi
+
+          echo "Docker access mode: ${DOCKER_MODE}"
+          compose_cmd version
+
+          IMAGE_TAG="${IMAGE_TAG}" DOCKER_BUILDKIT=1 compose_cmd \
             --env-file "${shared_dir}/.env" \
             -f "${release_dir}/deploy/docker-compose.yaml" \
             config >/tmp/geo-rankly-compose.yaml
 
-          IMAGE_TAG="${IMAGE_TAG}" DOCKER_BUILDKIT=1 docker compose \
+          IMAGE_TAG="${IMAGE_TAG}" DOCKER_BUILDKIT=1 compose_cmd \
             --env-file "${shared_dir}/.env" \
             -f "${release_dir}/deploy/docker-compose.yaml" \
             up -d --build --remove-orphans
 
           ln -sfn "${release_dir}" "${DEPLOY_BASE}/current"
 
-          IMAGE_TAG="${IMAGE_TAG}" docker compose \
+          IMAGE_TAG="${IMAGE_TAG}" compose_cmd \
             --env-file "${shared_dir}/.env" \
             -f "${release_dir}/deploy/docker-compose.yaml" \
             ps
@@ -206,6 +233,8 @@ jobs:
               | xargs -r rm -rf
           fi
           REMOTE_SCRIPT
+          } | SSHPASS="${NAS_SSH_PASSWORD}" sshpass -e ssh ${ssh_opts} "${remote}" \
+            "DEPLOY_BASE='${DEPLOY_BASE}' RELEASE_ID='${RELEASE_ID}' IMAGE_TAG='${IMAGE_TAG}' KEEP_RELEASES='${KEEP_RELEASES}' sh -se"
 
       - name: Deployment summary
         run: |