diff --git a/.forgejo/workflows/build-rust.yml b/.forgejo/workflows/build-rust.yml
index 2df1ad3..9ed49e1 100644
--- a/.forgejo/workflows/build-rust.yml
+++ b/.forgejo/workflows/build-rust.yml
@@ -19,10 +19,21 @@ jobs:
     runs-on: [self-hosted, linux, x86_64, burrow-forge]
     steps:
       - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
+        shell: bash
+        run: |
+          set -euo pipefail
+          repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          if [ ! -d .git ]; then
+            git init .
+          fi
+          if git remote get-url origin >/dev/null 2>&1; then
+            git remote set-url origin "${repo_url}"
+          else
+            git remote add origin "${repo_url}"
+          fi
+          git fetch --force --tags origin "${GITHUB_SHA}"
+          git checkout --force --detach FETCH_HEAD
+          git clean -ffdqx
 
       - name: Test
         shell: bash
diff --git a/.forgejo/workflows/build-site.yml b/.forgejo/workflows/build-site.yml
index 6f7c5e2..239b3b2 100644
--- a/.forgejo/workflows/build-site.yml
+++ b/.forgejo/workflows/build-site.yml
@@ -19,10 +19,21 @@ jobs:
     runs-on: [self-hosted, linux, x86_64, burrow-forge]
     steps:
       - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
+        shell: bash
+        run: |
+          set -euo pipefail
+          repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          if [ ! -d .git ]; then
+            git init .
+          fi
+          if git remote get-url origin >/dev/null 2>&1; then
+            git remote set-url origin "${repo_url}"
+          else
+            git remote add origin "${repo_url}"
+          fi
+          git fetch --force --tags origin "${GITHUB_SHA}"
+          git checkout --force --detach FETCH_HEAD
+          git clean -ffdqx
 
       - name: Build
         shell: bash
diff --git a/.forgejo/workflows/lint-governance.yml b/.forgejo/workflows/lint-governance.yml
index 490702e..2db94cc 100644
--- a/.forgejo/workflows/lint-governance.yml
+++ b/.forgejo/workflows/lint-governance.yml
@@ -15,10 +15,21 @@ jobs:
     runs-on: [self-hosted, linux, x86_64, burrow-forge]
     steps:
       - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
+        shell: bash
+        run: |
+          set -euo pipefail
+          repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          if [ ! -d .git ]; then
+            git init .
+          fi
+          if git remote get-url origin >/dev/null 2>&1; then
+            git remote set-url origin "${repo_url}"
+          else
+            git remote add origin "${repo_url}"
+          fi
+          git fetch --force --tags origin "${GITHUB_SHA}"
+          git checkout --force --detach FETCH_HEAD
+          git clean -ffdqx
 
       - name: Validate BEP metadata
         shell: bash