diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index b42c71da3..cb34f7d0d 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "18237bc01512b05cb7b5b795955485fbb7393abb",
-  "syncedAt": "2026-04-29T02:43:41.978Z"
+  "sha": "ba0f2e948fc0a3cfcb03b3ddf6329197203d540d",
+  "syncedAt": "2026-04-29T02:49:40.192Z"
 }
diff --git a/docs/ci.md b/docs/ci.md
index 2e657d126..ba1d723db 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -45,6 +45,13 @@ provider failures easier to rerun and diagnose. The aggregate
 `native-live-extensions-media-music` shard names remain valid for manual
 one-shot reruns.
 
+The native live media shards run in
+`ghcr.io/openclaw/openclaw-live-media-runner:ubuntu-24.04`, built by the
+`Live Media Runner Image` workflow. That image preinstalls `ffmpeg` and
+`ffprobe`; media jobs only verify the binaries before setup. Keep Docker-backed
+live suites on normal Blacksmith runners, because container jobs are the wrong
+place to launch nested Docker tests.
+
 `OpenClaw Release Checks` uses the trusted workflow ref to resolve the selected
 ref once into a `release-package-under-test` tarball, then passes that artifact
 to both the live/E2E release-path Docker workflow and the package acceptance