diff --git a/.forgejo/workflows/build-hello-app.yml b/.forgejo/workflows/build-hello-app.yml
index 944ab95..2e4e15e 100644
--- a/.forgejo/workflows/build-hello-app.yml
+++ b/.forgejo/workflows/build-hello-app.yml
@@ -16,7 +16,17 @@ jobs:
       image: gcr.io/kaniko-project/executor:debug
       options: --entrypoint ""
     steps:
-      - uses: actions/checkout@v4
+      # actions/checkout@v4 needs a Node.js runtime, which this minimal
+      # kaniko image doesn't have (no package manager to add it either) -
+      # fetch the repo as a plain tarball from Forgejo's archive endpoint
+      # instead, using the tools that are actually present (wget, tar).
+      - name: Checkout (manual - no git/node in this image)
+        run: |
+          wget --header="Authorization: token ${{ secrets.FORGEJO_TOKEN }}" \
+            -O /tmp/source.tar.gz \
+            "https://git.boglabob.com/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
+          tar -xzf /tmp/source.tar.gz --strip-components=1 -C "${{ github.workspace }}"
+          rm /tmp/source.tar.gz
 
       - name: Write registry auth
         run: |