diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index cfdda27..a8f7d8b 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -52,8 +52,7 @@ jobs:
       # pkgcore (pkgcheck) only reads /etc/portage/repos.conf, and the binhost
       # needs the Gentoo release keys we don't ship — disable binpkg signature
       # verification (ephemeral CI container) so prebuilt deps like dev-lang/go
-      # can be pulled instead of compiled. dev-vcs/git is pulled here too because
-      # actions/checkout (next step) shells out to git, and stage3 has none.
+      # can be pulled instead of compiled.
       - name: Configure portage
         run: |
           mkdir -p /etc/portage/repos.conf
@@ -61,22 +60,30 @@ jobs:
             > /etc/portage/repos.conf/gentoo.conf
           sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
           printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
-          emerge -q --getbinpkg dev-vcs/git dev-util/pkgcheck
+          emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck
 
-      # Check out the overlay into the workspace (plain SHA-1 repo, so no
-      # GIT_DEFAULT_HASH override), then register that path with portage.
+      # Place this overlay at /var/db/repos/azy5030 via curl + tar. actions/checkout
+      # can't run here: this job uses the gentoo/stage3 container, and the Gitea
+      # runner executes JS actions with `node` *inside* that container
+      # (`docker exec node …`) — stage3 ships no node, so checkout fails with
+      # exit 127. (The lint job uses actions/checkout fine: it has no container:
+      # and runs in the runner's default node-capable image.)
       - name: Check out overlay
-        uses: actions/checkout@v4
-
-      - name: Register overlay with portage
+        env:
+          TOKEN: ${{ github.token }}
         run: |
-          printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$GITHUB_WORKSPACE" \
+          host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
+          url="http://x-access-token:${TOKEN}@${host}/${GITHUB_REPOSITORY}/archive/${GITHUB_REF_NAME}.tar.gz"
+          curl -fsSL "$url" -o repo.tar.gz
+          mkdir -p /var/db/repos/azy5030
+          tar xzf repo.tar.gz -C /var/db/repos/azy5030 --strip-components=1
+          printf '[azy5030]\nlocation = /var/db/repos/azy5030\nmasters = gentoo\nauto-sync = false\n' \
             > /etc/portage/repos.conf/azy5030.conf
           mkdir -p /etc/portage/package.accept_keywords
           echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
 
       - name: QA scan
-        run: pkgcheck scan --repo "$GITHUB_WORKSPACE" dev-util/gitea-runner
+        run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner
 
       # Full source build: portage fetches the upstream source tarball and the
       # vendor tarball (release asset), verifies them against the committed
@@ -86,7 +93,7 @@ jobs:
 
       - name: Verify binary
         run: |
-          ver=$(find "$GITHUB_WORKSPACE/dev-util/gitea-runner" -name 'gitea-runner-*.ebuild' \
+          ver=$(find /var/db/repos/azy5030/dev-util/gitea-runner -name 'gitea-runner-*.ebuild' \
             | sed -E 's#.*/gitea-runner-(.*)\.ebuild#\1#' | sort -V | tail -1)
           gitea-runner --version
           gitea-runner --version | grep -q "v${ver}"
diff --git a/CLAUDE.md b/CLAUDE.md
index bd5fe38..2fc6cdb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -65,10 +65,14 @@ Runs on every push, two jobs. A **`lint`** job runs on the plain Docker-backend
 `just lint` (markdownlint/shellcheck/yamllint/actionlint). The **`build`** job has
 `needs: lint` (lint is a gate) and runs inside a `gentoo/stage3:amd64-openrc` container:
 `emerge-webrsync` to sync `::gentoo` → configure portage (disables binpkg signature
-verification so prebuilt deps like `dev-lang/go` are pulled, not compiled; also pulls
-`dev-vcs/git`, which `actions/checkout` needs and stage3 lacks) → `actions/checkout`
-into `$GITHUB_WORKSPACE`, registered as the overlay via `repos.conf` →
-`pkgcheck scan` → `emerge` → assert `gitea-runner --version` matches the ebuild version.
+verification so prebuilt deps like `dev-lang/go` are pulled, not compiled) → **check out
+via `curl + tar`, not `actions/checkout`** into `/var/db/repos/azy5030` → `pkgcheck scan`
+→ `emerge` → assert `gitea-runner --version` matches the ebuild version.
+
+The build job can't use `actions/checkout` (even though the lint job does): the Gitea
+runner executes JS actions by `docker exec node …` *inside* the job container, and
+`gentoo/stage3` ships no node, so any JS action fails with exit 127. The lint job has no
+`container:`, so it runs in the runner's default node-capable image and checkout works.
 
 ## Conventions / gotchas