diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index d0fa067..d97feb1 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -27,6 +27,17 @@ jobs:
       DOCKER_TLS_VERIFY: "1"
       DOCKER_CERT_PATH: /docker-certs/client
     steps:
+      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
+      # `node`, which docker:27-cli (Alpine) doesn't ship. Without this the
+      # checkout step fails with "exec: node: executable file not found in
+      # $PATH" before any of the job's own steps run. Verified locally:
+      # `apk add --no-cache nodejs git` in this exact image gets node v22 +
+      # git 2.47, and the checkout action's dist/index.js then actually
+      # executes (confirmed by running it directly) instead of failing on a
+      # missing binary.
+      - name: install node (required by JS-based actions)
+        run: apk add --no-cache nodejs git
+
       - uses: actions/checkout@v4
 
       - name: Get short SHA
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index c2d5357..63930a7 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -28,6 +28,14 @@ jobs:
     container:
       image: golang:1.25-bookworm
     steps:
+      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
+      # `node`, which golang:1.25-bookworm doesn't ship. Without this the
+      # checkout step fails with "exec: node: executable file not found in
+      # $PATH" before any of the job's own steps run. Same fix already in use
+      # in kmsvc-manage's ci.yaml; carried over here.
+      - name: install node (required by JS-based actions)
+        run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git
+
       - uses: actions/checkout@v4
 
       - name: go vet