diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index 02d7a1a..daeb1f4 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -10,9 +10,15 @@ jobs:
     container:
       image: bufbuild/buf:latest
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      # actions/checkout@v4 is a JS action — it needs `node` inside the job's
+      # container to run, but bufbuild/buf has no Node.js. Plain git clone has
+      # no such dependency and works in any image.
+      - name: checkout
+        env:
+          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git clone "https://x-access-token:${GIT_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+          git checkout "${GITHUB_SHA}"
 
       - name: buf lint
         run: buf lint
@@ -26,7 +32,14 @@ jobs:
     container:
       image: golang:1.25
     steps:
-      - uses: actions/checkout@v4
+      # Same reason as the buf job: golang:1.25 has no Node.js, so the JS
+      # action actions/checkout@v4 can't run here — plain git clone instead.
+      - name: checkout
+        env:
+          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git clone "https://x-access-token:${GIT_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+          git checkout "${GITHUB_SHA}"
 
       - name: Install buf and protoc plugins
         run: |