diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index a618001..e70f14e 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -8,10 +8,23 @@ jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.14
+      - name: Checkout repository
+        # Plain git instead of actions/checkout: rootless podman on cirunner-vps
+        # rejects symlinks inside cached actions ("path escapes from parent").
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+        run: |
+          git init -q .
+          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
+          git -c http.extraHeader="Authorization: basic $auth" \
+            fetch -q --depth 1 origin "${{ gitea.sha }}"
+          git checkout -q FETCH_HEAD
+      - name: Set up Bun
+        # Install script instead of oven-sh/setup-bun (same podman symlink issue).
+        run: |
+          curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.14" >/dev/null
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
       - run: bun install --frozen-lockfile
       - name: Typecheck and test
         run: |
@@ -22,7 +35,18 @@ jobs:
     needs: [quality]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        # Plain git instead of actions/checkout: rootless podman on cirunner-vps
+        # rejects symlinks inside cached actions ("path escapes from parent").
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+        run: |
+          git init -q .
+          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
+          git -c http.extraHeader="Authorization: basic $auth" \
+            fetch -q --depth 1 origin "${{ gitea.sha }}"
+          git checkout -q FETCH_HEAD
       - name: Log in to container registry
         run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
       # One build-and-push step, fully-qualified tags, --push from the builder.