diff --git a/.forgejo/workflows/build-hello-app.yml b/.forgejo/workflows/build-hello-app.yml
index 2e4e15e..5e36427 100644
--- a/.forgejo/workflows/build-hello-app.yml
+++ b/.forgejo/workflows/build-hello-app.yml
@@ -23,10 +23,10 @@ jobs:
       - name: Checkout (manual - no git/node in this image)
         run: |
           wget --header="Authorization: token ${{ secrets.FORGEJO_TOKEN }}" \
-            -O /tmp/source.tar.gz \
+            -O "${{ github.workspace }}/source.tar.gz" \
             "https://git.boglabob.com/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
-          tar -xzf /tmp/source.tar.gz --strip-components=1 -C "${{ github.workspace }}"
-          rm /tmp/source.tar.gz
+          tar -xzf "${{ github.workspace }}/source.tar.gz" --strip-components=1 -C "${{ github.workspace }}"
+          rm "${{ github.workspace }}/source.tar.gz"
 
       - name: Write registry auth
         run: |
diff --git a/docs/03-flux.md b/docs/03-flux.md
index 74db272..b6cf8e6 100644
--- a/docs/03-flux.md
+++ b/docs/03-flux.md
@@ -404,7 +404,12 @@ publishes a new image and roll it out — that's
 (`ImageRepository`/`ImagePolicy`/`ImageUpdateAutomation`, all commented in
 that file).
 
-Exercise the whole loop end to end:
+Exercise the whole loop end to end. Unlike the rest of this stage, this
+runs on your **desktop** (the `maq` clone from `docs/01-bootstrap.md` step
+4), not as `k8s` on the T630 — `k8s`'s own git access (`k8s-readonly`) is
+read-only by design, so it can't push. Once pushed, Forgejo Actions picks
+it up on its own self-hosted runner automatically; you don't need to be on
+the T630 for any of this step:
 
 ```sh
 sed -i 's/This page is served from it\./This page is served from it — and this line proves it: edited via git push./' apps/hello-app/src/index.html