diff --git a/.gitea/workflows/build-next.yml b/.gitea/workflows/build-next.yml
index 215ddc8..6187ec5 100644
--- a/.gitea/workflows/build-next.yml
+++ b/.gitea/workflows/build-next.yml
@@ -27,10 +27,23 @@ jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.10
+      - name: Checkout repository
+        # Plain git instead of actions/checkout: rootless podman on cirunner-vps
+        # rejects symlinks inside cached actions ("path escapes from parent").
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+        run: |
+          git init -q .
+          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
+          git -c http.extraHeader="Authorization: basic $auth" \
+            fetch -q --depth 1 origin "${{ gitea.sha }}"
+          git checkout -q FETCH_HEAD
+      - name: Set up Bun
+        # Install script instead of oven-sh/setup-bun (same podman symlink issue).
+        run: |
+          curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.10" >/dev/null
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
       - run: ./scripts/ci-install
       - name: Lint, typecheck, and test
         env:
@@ -46,12 +59,25 @@ jobs:
     needs: [quality]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        # Plain git instead of actions/checkout: rootless podman on cirunner-vps
+        # rejects symlinks inside cached actions ("path escapes from parent").
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+        run: |
+          git init -q .
+          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
+          git -c http.extraHeader="Authorization: basic $auth" \
+            fetch -q --depth 1 origin "${{ gitea.sha }}"
+          git checkout -q FETCH_HEAD
       - name: Log in to container registry
         run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.10
+      - name: Set up Bun
+        # Install script instead of oven-sh/setup-bun (same podman symlink issue).
+        run: |
+          curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.10" >/dev/null
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
       - run: ./scripts/ci-install
       - name: Build Next image
         env: