diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 5b9afae..f993cd9 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -6,14 +6,14 @@ on:
     branches: [dev, release]
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ultix
     container:
       image: node:20-bookworm
     steps:
       - uses: actions/checkout@v4
       - name: yamllint
         run: |
-          pip install --quiet yamllint
+          apt-get update -qq >/dev/null && apt-get install -qq -y python3-pip >/dev/null && pip install --quiet --break-system-packages yamllint
           yamllint -c .yamllint .
       - name: secret scan
         run: |
diff --git a/.yamllint b/.yamllint
index 418c3c2..4148a69 100644
--- a/.yamllint
+++ b/.yamllint
@@ -3,12 +3,15 @@
 extends: default
 ignore: |
   docs/
+  secrets.yaml
+  *.db
 rules:
   line-length: disable
   comments: disable
   comments-indentation: disable
   document-start: disable
-  truthy: check-keys: false
+  truthy:
+    check-keys: false
   indentation:
     spaces: consistent
     indent-sequences: consistent
diff --git a/packages/deploy_pipeline.yaml b/packages/deploy_pipeline.yaml
index c346c8e..da5337d 100644
--- a/packages/deploy_pipeline.yaml
+++ b/packages/deploy_pipeline.yaml
@@ -6,7 +6,7 @@
 # (founder action via Cloudron file manager); this watcher is the
 # always-works safety net.
 rest:
-  - resource: https://git.knownelement.com/api/v1/repos/KNEL/pfv-bms/commits?sha=release&limit=1
+  - resource: https://git.knownelement.com/api/v1/repos/KNEL/KNELBMS/commits?sha=release&limit=1
     headers:
       Authorization: !secret gitea_auth_header
       User-Agent: pfv-bms-deploy-watch