diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
index e01288d..5968dc5 100644
--- a/.forgejo/workflows/validate.yml
+++ b/.forgejo/workflows/validate.yml
@@ -6,8 +6,10 @@ on:
     branches: [main]
 
 # The repository uses the sha256 git object format. Git < 2.42 cannot speak
-# the sha256 wire protocol, so we must run the job in a container whose Debian
-# base has a recent-enough git (bookworm ships 2.39, trixie ships 2.47+).
+# the sha256 wire protocol, and actions/checkout@v4 does `git init` without
+# --object-format=sha256, which produces `fatal: mismatched algorithms:
+# client sha1; server sha256`. We therefore skip actions/checkout entirely
+# and clone manually from a trixie-based container (git 2.47+).
 jobs:
   json-schema:
     name: JSON Schema (ajv)
@@ -21,19 +23,23 @@ jobs:
           apt-get update
           apt-get install -y --no-install-recommends git curl ca-certificates
           git --version
-          node --version
 
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - name: Clone repository (sha256-aware)
+        run: |
+          set -euo pipefail
+          git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
+            "https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
+          cd "${GITHUB_WORKSPACE}"
+          git log -1 --oneline
 
       - name: Install ajv-cli + ajv-formats
+        working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
           npm install --prefix /tmp/ajv ajv-cli@5 ajv-formats@3
 
       - name: Validate every JSON Schema parses as JSON
+        working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
           find schemas -type f -name '*.json' -print | while read -r f; do
@@ -42,6 +48,7 @@ jobs:
           done
 
       - name: Meta-validate each schema against JSON Schema 2020-12
+        working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
           export NODE_PATH=/tmp/ajv/node_modules
@@ -51,6 +58,7 @@ jobs:
           done
 
       - name: Validate example payloads against their schemas (if any)
+        working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
           export NODE_PATH=/tmp/ajv/node_modules
@@ -77,10 +85,13 @@ jobs:
           apt-get install -y --no-install-recommends git curl ca-certificates
           git --version
 
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - name: Clone repository (sha256-aware)
+        run: |
+          set -euo pipefail
+          git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
+            "https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
+          cd "${GITHUB_WORKSPACE}"
+          git log -1 --oneline
 
       - name: Install OPA
         run: |
@@ -92,7 +103,9 @@ jobs:
           "$HOME/.local/bin/opa" version
 
       - name: opa fmt (fail on any diff)
+        working-directory: ${{ github.workspace }}
         run: opa fmt --list --diff policies/
 
       - name: opa test
+        working-directory: ${{ github.workspace }}
         run: opa test policies/ -v