diff --git a/.gitea/workflows/build-caddy.yaml b/.gitea/workflows/build-caddy.yaml
index 7db7893c..bec19d0c 100644
--- a/.gitea/workflows/build-caddy.yaml
+++ b/.gitea/workflows/build-caddy.yaml
@@ -2,6 +2,7 @@ name: Build Caddy Custom
 
 on:
   push:
+    branches: [ main, master ]
     paths:
       - '.gitea/workflows/build-caddy.yaml'
   workflow_dispatch:
@@ -23,14 +24,13 @@ jobs:
 
       - name: Build Caddy
         run: |
-          export PATH=$PATH:$(go env GOPATH)/bin
-          xcaddy build v2.9.1 \
+          $(go env GOPATH)/bin/xcaddy build v2.9.1 \
             --with github.com/caddy-dns/cloudflare \
             --with github.com/ss098/certmagic-s3 \
             --output caddy
 
       - name: Upload to Gitea Package Registry
         run: |
-          curl --user "${{ gitea.actor }}:${{ secrets.GITHUB_TOKEN }}" \
+          curl -v --fail-with-body --user "${{ gitea.actor }}:${{ secrets.GITHUB_TOKEN }}" \
             --upload-file caddy \
             "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/generic/caddy-custom/v2.9.1/caddy"
diff --git a/ansible/roles/caddy-ha/defaults/main.yml b/ansible/roles/caddy-ha/defaults/main.yml
index 618390be..81e73c15 100644
--- a/ansible/roles/caddy-ha/defaults/main.yml
+++ b/ansible/roles/caddy-ha/defaults/main.yml
@@ -15,3 +15,9 @@ caddy_ha_s3_insecure: true
 # Admin credentials for setup (should be loaded from secure vars/vault)
 # caddy_ha_s3_admin_access_key: "..."
 # caddy_ha_s3_admin_secret_key: "..."
+
+caddy_version: "v2.9.1"
+
+# Caddy Binary Download URL
+# Replace 'owner' with the user/org where the caddy-builder repo is located
+caddy_ha_caddy_binary_url: "https://gitea.renner.uno/api/packages/krenner/generic/caddy-custom/{{ caddy_version }}/caddy"
diff --git a/ansible/roles/caddy-ha/tasks/main.yml b/ansible/roles/caddy-ha/tasks/main.yml
index d46e3fb3..7c8f4106 100644
--- a/ansible/roles/caddy-ha/tasks/main.yml
+++ b/ansible/roles/caddy-ha/tasks/main.yml
@@ -34,50 +34,11 @@
       - keepalived
       - curl
       - tar
+      - libcap2-bin
     state: present
     update_cache: yes
   register: result
 
-- name: Remove old golang
-  apt:
-    name: golang
-    state: absent
-
-- name: Download Go
-  get_url:
-    url: https://go.dev/dl/go1.23.4.linux-amd64.tar.gz
-    dest: /tmp/go.tar.gz
-
-- name: Extract Go
-  unarchive:
-    src: /tmp/go.tar.gz
-    dest: /usr/local
-    remote_src: yes
-    creates: /usr/local/go/bin/go
-
-- name: Link Go binary
-  file:
-    src: /usr/local/go/bin/go
-    dest: /usr/bin/go
-    state: link
-  
-- name: Add xcaddy GPG key
-  apt_key:
-    url: https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key
-    state: present
-
-- name: Add xcaddy repository
-  apt_repository:
-    repo: "deb https://dl.cloudsmith.io/public/caddy/xcaddy/deb/debian any-version main"
-    state: present
-    filename: caddy-xcaddy
-
-- name: Install xcaddy
-  apt:
-    name: xcaddy
-    state: present
-    update_cache: yes
-
 - name: Ensure caddy group exists
   group:
     name: caddy
@@ -94,23 +55,20 @@
     create_home: yes
     state: present
 
-- name: Check for Caddy binary and plugins
-  shell: |
-    if [ -f /usr/bin/caddy ]; then
-      /usr/bin/caddy list-modules | grep -q "dns.providers.cloudflare" && \
-      /usr/bin/caddy list-modules | grep -q "storage.s3"
-    else
-      exit 1
-    fi
-  register: caddy_check
-  failed_when: false
-  changed_when: false
-
-- name: Build Caddy with Cloudflare and S3 plugins
-  command:
-    cmd: xcaddy build v2.9.1 --with github.com/caddy-dns/cloudflare --with github.com/ss098/certmagic-s3 --output /usr/bin/caddy
-  when: caddy_check.rc != 0
+- name: Download Caddy Custom Binary
+  get_url:
+    url: "{{ caddy_ha_caddy_binary_url }}"
+    dest: /usr/bin/caddy
+    mode: '0755'
+    owner: root
+    group: root
   notify: Reload Caddy
+  register: caddy_download
+
+# Compatibility: Allow binding to 80/443 without root
+- name: Set capabilities for Caddy
+  command: setcap cap_net_bind_service=+ep /usr/bin/caddy
+  when: caddy_download.changed
 
 - name: Create Caddy config directory
   file: