diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index daeb1f4..035434d 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -13,6 +13,18 @@ jobs:
       # actions/checkout@v4 is a JS action — it needs `node` inside the job's
       # container to run, but bufbuild/buf has no Node.js. Plain git clone has
       # no such dependency and works in any image.
+      #
+      # The runner's own homelab CA isn't trusted by this container's
+      # default CA bundle, so https clone fails cert verification — install
+      # the CA before cloning.
+      - name: trust homelab CA
+        env:
+          HOMELAB_CA_CERT: ${{ secrets.HOMELAB_CA_CERT }}
+        run: |
+          mkdir -p /usr/local/share/ca-certificates
+          echo "$HOMELAB_CA_CERT" > /usr/local/share/ca-certificates/homelab-ca.crt
+          update-ca-certificates
+
       - name: checkout
         env:
           GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -34,6 +46,15 @@ jobs:
     steps:
       # Same reason as the buf job: golang:1.25 has no Node.js, so the JS
       # action actions/checkout@v4 can't run here — plain git clone instead.
+      - name: trust homelab CA
+        env:
+          HOMELAB_CA_CERT: ${{ secrets.HOMELAB_CA_CERT }}
+        run: |
+          mkdir -p /usr/local/share/ca-certificates
+          echo "$HOMELAB_CA_CERT" > /usr/local/share/ca-certificates/homelab-ca.crt
+          apt-get update -qq && apt-get install -y -qq ca-certificates >/dev/null
+          update-ca-certificates
+
       - name: checkout
         env:
           GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}