diff --git a/.gitea/workflows/update.yml b/.gitea/workflows/update.yml
index 1e3e19ef63..2888da5b1e 100644
--- a/.gitea/workflows/update.yml
+++ b/.gitea/workflows/update.yml
@@ -1,31 +1,118 @@
+
 name: NVD CPE and Match Criteria Mirror
+
 on:
   workflow_dispatch:
   schedule:
     - cron: "19 */4 * * *"
 
+permissions:
+  contents: write
+
+concurrency:
+  group: vuln-cpe-update
+  cancel-in-progress: false
+
 jobs:
   update:
+    name: Update NVD CPE
     runs-on: vulnerability
     timeout-minutes: 240
+
     env:
       CACHE_ROOT: /vuln-cache/vuln-cpe
       REPO_URL: https://git.apex-project.de/VULN/vuln-cpe.git
+
       GITEA_JOB_TOKEN: ${{ secrets.GITEA_TOKEN }}
       NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+
+      NVD_MAX_PAGES: "20"
+
     steps:
-      - name: Cached sync
+      - name: Install dependencies
         shell: bash
         run: |
           set -Eeuo pipefail
-          : "${GITEA_JOB_TOKEN:?Gitea Job Token fehlt}"
+
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            git \
+            python3 \
+            util-linux \
+            ca-certificates \
+            coreutils
+
+          git --version
+          python3 --version
+          flock --version
+
+      - name: Verify persistent cache
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
           mkdir -p "$CACHE_ROOT"
+
+          test -w "$CACHE_ROOT" || {
+            echo "ERROR: Cache not writable"
+            exit 1
+          }
+
+          echo "Cache: $CACHE_ROOT"
+          df -h "$CACHE_ROOT"
+
+      - name: Sync NVD CPE
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          umask 077
+
+          : "${GITEA_JOB_TOKEN:?GITEA_TOKEN fehlt}"
+
+          mkdir -p "$CACHE_ROOT"
+
+          # Prevent concurrent jobs using this cache
           exec 9>"$CACHE_ROOT/.sync.lock"
-          flock -w 300 9
+
+          flock -w 300 9 || {
+            echo "Another CPE update is running"
+            exit 1
+          }
+
+          # Authenticate Git without storing the token
           export GIT_CONFIG_COUNT=1
           export GIT_CONFIG_KEY_0=http.extraHeader
           export GIT_CONFIG_VALUE_0="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
+
+          # Bootstrap persistent checkout
           if [ ! -d "$CACHE_ROOT/repo/.git" ]; then
-            git clone --depth 1 --branch main "$REPO_URL" "$CACHE_ROOT/repo"
+            echo "Creating persistent Git checkout"
+
+            git clone \
+              --depth 1 \
+              --branch main \
+              "$REPO_URL" \
+              "$CACHE_ROOT/repo"
           fi
+
+          # Existing sync script handles:
+          # - Git fetch
+          # - NVD CPE API
+          # - NVD CPE Match API
+          # - Validation
+          # - Git commit and push
+
           bash "$CACHE_ROOT/repo/scripts/run-cached.sh"
+
+      - name: Show cache usage
+        if: always()
+        shell: bash
+        run: |
+          echo "Persistent cache usage:"
+
+          if [ -d "$CACHE_ROOT" ]; then
+            du -sh "$CACHE_ROOT"
+          fi
+
+          echo "Finished"
+