diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 3f5b0f4..36d9e9c 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -12,7 +12,11 @@ jobs:
     container:
       image: python:3.12-alpine
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        run: |
+          apk add --no-cache -q git
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
       - name: Install ruff
         run: pip install --no-cache-dir -q ruff
       - name: Lint
@@ -24,7 +28,11 @@ jobs:
     container:
       image: python:3.12-alpine
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        run: |
+          apk add --no-cache -q git
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
       - name: Install deps
         run: |
           pip install --no-cache-dir -q -r requirements.txt
@@ -38,9 +46,10 @@ jobs:
       image: ghcr.io/gitleaks/gitleaks:latest
       options: --entrypoint ""
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - name: Checkout
+        run: |
+          git clone --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
       - name: Scan for secrets
         run: gitleaks detect --source . -v