diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a236b86..cdff7e5 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -49,7 +49,16 @@ jobs:
         VENV=/volume1/gitea/python_venv
         if ! "$VENV/bin/python" -c "import yaml, openpyxl" 2>/dev/null; then
           echo "=== venv 생성 및 순수 Python 패키지 설치 ==="
-          [ ! -f "$VENV/bin/pip" ] && /usr/bin/python3 -m venv "$VENV"
+          [ ! -d "$VENV" ] && /usr/bin/python3 -m venv "$VENV"
+          
+          # Synology Python 3.8은 ensurepip가 없어 venv 생성 시 pip가 누락될 수 있음
+          if [ ! -f "$VENV/bin/pip" ]; then
+            echo "pip missing in venv, installing via get-pip.py..."
+            curl -sS https://bootstrap.pypa.io/pip/3.8/get-pip.py -o get-pip.py
+            "$VENV/bin/python" get-pip.py --quiet
+            rm get-pip.py
+          fi
+
           "$VENV/bin/pip" install --upgrade pip --quiet
           "$VENV/bin/pip" install pyyaml openpyxl --quiet
           if [ -f requirements.txt ]; then
@@ -68,6 +77,7 @@ jobs:
         # package-lock.json 해시로 캐시 유효성 판단
         CACHE_BASE=/volume1/gitea/node_cache
         LOCK_HASH=$(md5sum package-lock.json 2>/dev/null | cut -d' ' -f1 || echo "no-lock")
+        [ -z "$LOCK_HASH" ] && LOCK_HASH="no-lock"
         CACHE_DIR="$CACHE_BASE/$LOCK_HASH"
 
         if [ -d "$CACHE_DIR/node_modules" ]; then
@@ -100,7 +110,7 @@ jobs:
       run: python3 tools/harness_coverage_auditor.py
 
     - name: Notify PR Result
-      if: always() && github.event_name == 'pull_request'
+      if: github.event_name == 'pull_request'
       run: |
         STATUS="${{ job.status }}"
         PR_NUM="${{ github.event.pull_request.number }}"