diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 1d08c01..3031465 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -33,49 +33,48 @@ jobs:
         with:
           cluster_name: stackrox-mcp-smoke
 
+      - name: Resolve latest StackRox nightly tag
+        id: stackrox-tag
+        run: |
+          # Quay returns tags newest first. Only the multi-arch tag is a manifest list (the -amd64/-arm64/... tags are not).
+          tag="$(curl -fsSL 'https://quay.io/api/v1/repository/stackrox-io/main/tag/?limit=15&onlyActiveTags=true&filter_tag_name=like:nightly' \
+            | jq -r '[.tags[] | select(.is_manifest_list) | .name] | first')"
+          [[ -n "$tag" && "$tag" != "null" ]] || { echo "No nightly tag found"; exit 1; }
+          echo "Using StackRox tag: ${tag}"
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+
       - name: Checkout StackRox repository
         uses: actions/checkout@v7
         with:
           repository: stackrox/stackrox
           path: stackrox-repo
 
-      - name: Deploy StackRox Central
+      - name: Deploy StackRox with roxie
         env:
-          MAIN_IMAGE_TAG: latest
-          SENSOR_HELM_DEPLOY: "true"
-          ROX_SCANNER_V4: "false"
-          ADMISSION_CONTROLLER: "false"
-          SCANNER_REPLICAS: "0"
-          COLLECTION_METHOD: "no_collection"
+          SKIP_ROXIE_DEPLOY_BANNER: "true"
+          STACKROX_TAG: ${{ steps.stackrox-tag.outputs.tag }}
         run: |
           cd stackrox-repo
-          ./deploy/k8s/deploy-local.sh
-
-      - name: Wait for Central pods ready
-        run: kubectl wait --for=condition=ready --timeout=180s pod -l app=central -n stackrox
-
-      - name: Remove resource constraints from Sensor
-        run: |
-          # Use kubectl set resources to remove all resource constraints
-          kubectl set resources deployment/sensor -n stackrox \
-            --requests=cpu=0,memory=0 \
-            --limits=cpu=0,memory=0
-
-          # Delete sensor pods to force recreation with new (empty) resources
-          kubectl delete pods -n stackrox -l app=sensor
-
-          # Wait a bit for pods to be deleted and recreated
-          sleep 10
-
-          # Wait for new pods to be ready
-          kubectl wait --for=condition=ready --timeout=300s pod -l app=sensor -n stackrox
+          ./deploy/deploy.sh \
+            --tag "${STACKROX_TAG}" \
+            --envrc "${RUNNER_TEMP}/roxie.env" \
+            --set roxie.imageRegistry=quay.io/stackrox-io \
+            --resources small \
+            --single-namespace \
+            --central-wait 10m \
+            --set central.spec.scannerV4.scannerComponent=Disabled \
+            --set securedCluster.spec.scannerV4.scannerComponent=Disabled \
+            --set securedCluster.spec.perNode.collector.collection=NoCollection \
+            --set securedCluster.spec.admissionControl.enforcement=Disabled \
+            --set securedCluster.spec.admissionControl.replicas=1
 
       - name: Extract Central password
         id: extract-password
         run: |
-          PASSWORD="$(cat stackrox-repo/deploy/k8s/central-deploy/password)"
-          echo "::add-mask::${PASSWORD}"
-          echo "password=${PASSWORD}" >> "$GITHUB_OUTPUT"
+          # shellcheck source=/dev/null
+          source "${RUNNER_TEMP}/roxie.env"
+          echo "::add-mask::${ROX_ADMIN_PASSWORD}"
+          echo "password=${ROX_ADMIN_PASSWORD}" >> "$GITHUB_OUTPUT"
 
       - name: Setup port-forward to Central
         run: stackrox-repo/scale/dev/port-forward.sh 8000