diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 30e9132..92658ef 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -30,16 +30,21 @@ jobs:
   # Real load validation: boots Home Assistant against the repo config and
   # proves HA can parse + set up every integration (yamllint only proves the
   # YAML parses; this catches unknown keys, bad Jinja, schema drift).
-  # Pinned to the HA version the box runs. HA 2026.8 requires python
-  # >=3.14.2 (pip refuses older), and the base must be glibc debian — the
-  # runner mounts a glibc node for checkout, alpine cannot exec it.
-  # Stub secrets are CI-only fixtures — never present on the live box.
+  # Pinned to the HA version the box runs (needs python >=3.14).
+  # actions/checkout is NOT used: it needs node in the job container, and
+  # python images have none (lint works because node:20 ships node).
+  # Clone with the job's auto token instead. Stub secrets are CI-only
+  # fixtures — never present on the live box.
   config-check:
     runs-on: ultix
     container:
       image: python:3.14-bookworm
     steps:
-      - uses: actions/checkout@v4
+      - name: clone
+        run: |
+          test -n "$GITHUB_TOKEN" || { echo "GITHUB_TOKEN missing"; exit 1; }
+          git clone --depth 1 "https://x-access-token:${GITHUB_TOKEN}@git.knownelement.com/${GITHUB_REPOSITORY}.git" .
+          git log -1 --oneline
       - name: install homeassistant 2026.8.3
         run: pip install --quiet homeassistant==2026.8.3
       - name: homeassistant check_config