diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 40f85c4..1a9bf0b 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -5,6 +5,10 @@ name: CI
 #
 # `runs-on: docker` matches the label exposed by the standard self-hosted
 # Forgejo runner. Change it if your runner was registered with another label.
+#
+# Actions are pinned to node20-compatible releases. Older forgejo-runner
+# versions (e.g. v6.4.0) reject any action whose action.yml declares
+# `using: node24` — checkout v4 is the last line that runs on node20.
 
 on:
   push:
@@ -15,21 +19,26 @@ jobs:
     runs-on: docker
     steps:
       - name: Checkout
-        # Fully qualified so a changed DEFAULT_ACTIONS_URL can't break the run.
-        uses: https://data.forgejo.org/actions/checkout@v6
+        # v4 runs on node20 (v5+ require node24).
+        uses: https://data.forgejo.org/actions/checkout@v4
 
       - name: Install uv
-        uses: https://data.forgejo.org/astral-sh/setup-uv@v10
-        with:
-          python-version: "3.13"
+        # Installed from the official script rather than a Node action so the
+        # job works on runners that only support node20.
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          export PATH="$HOME/.local/bin:$PATH"
+          uv python install 3.13
+          uv --version
 
       - name: Lint (ruff)
-        run: uvx ruff check .
+        run: uvx --python 3.13 ruff check .
 
       - name: Test (pytest)
         # The suite only needs pytest: cadence.py imports nothing third-party
         # at module level, so no torch/whisper/ffmpeg is required here.
-        run: uv run --with pytest pytest -q
+        run: uv run --python 3.13 --with pytest pytest -q
 
   version-bump:
     # Only meaningful on pull requests, where there is a base branch to diff
@@ -38,7 +47,7 @@ jobs:
     runs-on: docker
     steps:
       - name: Checkout
-        uses: https://data.forgejo.org/actions/checkout@v6
+        uses: https://data.forgejo.org/actions/checkout@v4
         with:
           # Full history so the base branch is reachable for the comparison.
           fetch-depth: 0