diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
index 72a9d05..d28e575 100644
--- a/.forgejo/workflows/validate.yml
+++ b/.forgejo/workflows/validate.yml
@@ -10,16 +10,20 @@ jobs:
     name: JSON Schema (ajv)
     runs-on: ubuntu-latest
     steps:
+      - name: Install prerequisites in container
+        run: |
+          set -euo pipefail
+          command -v curl >/dev/null || { apt-get update && apt-get install -y curl ca-certificates; }
+          node --version
+          npm --version
+
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-
-      - name: Install ajv
-        run: npm install -g ajv-cli@5 ajv-formats@3
+      - name: Install ajv-cli + ajv-formats
+        run: |
+          set -euo pipefail
+          npm install --prefix /tmp/ajv ajv-cli@5 ajv-formats@3
 
       - name: Validate every JSON Schema parses as JSON
         run: |
@@ -29,26 +33,26 @@ jobs:
             node -e "require('./$f')"
           done
 
-      - name: Validate each schema is itself valid against JSON Schema 2020-12
+      - name: Meta-validate each schema against JSON Schema 2020-12
         run: |
           set -euo pipefail
+          export NODE_PATH=/tmp/ajv/node_modules
           find schemas -type f -name '*.json' -print | while read -r f; do
             echo "--- meta-validate: $f"
-            ajv compile --spec=draft2020 -c ajv-formats -s "$f"
+            node /tmp/ajv/node_modules/.bin/ajv compile --spec=draft2020 -c=ajv-formats -s "$f"
           done
 
-      - name: Validate example payloads against their schemas
+      - name: Validate example payloads against their schemas (if any)
         run: |
           set -euo pipefail
+          export NODE_PATH=/tmp/ajv/node_modules
           shopt -s nullglob
-          # Convention: schemas/.../v<version>.json may have sibling
-          # examples/*.json documents to validate against the schema.
           for schema in $(find schemas -type f -name '*.json'); do
             dir="$(dirname "$schema")/examples"
             [ -d "$dir" ] || continue
             for example in "$dir"/*.json; do
               echo "--- validate example $example against $schema"
-              ajv validate --spec=draft2020 -c ajv-formats -s "$schema" -d "$example"
+              node /tmp/ajv/node_modules/.bin/ajv validate --spec=draft2020 -c=ajv-formats -s "$schema" -d "$example"
             done
           done
 
@@ -56,15 +60,22 @@ jobs:
     name: Rego (opa fmt + opa test)
     runs-on: ubuntu-latest
     steps:
+      - name: Install prerequisites in container
+        run: |
+          set -euo pipefail
+          command -v curl >/dev/null || { apt-get update && apt-get install -y curl ca-certificates; }
+
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Install OPA
         run: |
           set -euo pipefail
-          curl -sSL -o /usr/local/bin/opa https://openpolicyagent.org/downloads/v1.9.0/opa_linux_amd64_static
-          chmod +x /usr/local/bin/opa
-          opa version
+          mkdir -p "$HOME/.local/bin"
+          curl -sSL -o "$HOME/.local/bin/opa" https://openpolicyagent.org/downloads/v1.9.0/opa_linux_amd64_static
+          chmod +x "$HOME/.local/bin/opa"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          "$HOME/.local/bin/opa" version
 
       - name: opa fmt (fail on any diff)
         run: opa fmt --list --diff policies/