diff --git a/.forgejo/workflows/dimensionlab-website.yml b/.forgejo/workflows/dimensionlab-website.yml
index 52cc868..198a8aa 100644
--- a/.forgejo/workflows/dimensionlab-website.yml
+++ b/.forgejo/workflows/dimensionlab-website.yml
@@ -52,10 +52,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: https://data.forgejo.org/actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: false
+        run: |
+          if [ -d .git ]; then
+            git remote set-url origin git@git.dimensionlab.net:vince/dimensionlab-website.git
+          else
+            git init
+            git remote add origin git@git.dimensionlab.net:vince/dimensionlab-website.git
+          fi
+          git fetch --force --prune --depth=1 origin "$GITHUB_SHA"
+          git checkout --force --detach "$GITHUB_SHA"
+          git clean -ffdx
 
       - name: Initialize submodules
         run: |
diff --git a/README.md b/README.md
index a1ae19e..85177c5 100644
--- a/README.md
+++ b/README.md
@@ -171,7 +171,9 @@ for `push` events on `refs/heads/main`.
 The workflow uses two runner classes. Pull request CI runs on the containerized
 `docker` runner. Production deployment runs on a separate host runner with the
 `deploy:host` label so the guarded deploy script can use the user's rootless
-`podman` and `systemctl --user` commands directly.
+`podman` and `systemctl --user` commands directly. The deploy job uses a
+shell-only `git fetch` checkout so the host runner does not need a Node runtime
+for checkout actions.
 
 ```yaml
 runner:
diff --git a/apps/web/src/lib/workspace-boundary.test.ts b/apps/web/src/lib/workspace-boundary.test.ts
index bdc978c..58cf203 100644
--- a/apps/web/src/lib/workspace-boundary.test.ts
+++ b/apps/web/src/lib/workspace-boundary.test.ts
@@ -278,6 +278,10 @@ describe("workspace boundaries", () => {
     expect(workflow).toContain("runs-on: deploy");
     expect(workflow).toContain("github.event_name == 'push'");
     expect(workflow).toContain("github.ref == 'refs/heads/main'");
+    expect(workflow).toContain(
+      "git remote add origin git@git.dimensionlab.net:vince/dimensionlab-website.git",
+    );
+    expect(workflow).toContain('git fetch --force --prune --depth=1 origin "$GITHUB_SHA"');
     expect(workflow).toContain("podman inspect dimensionlab-website");
     expect(workflow).toContain("DEPLOY_CONTAINER_CLI: podman");
     expect(workflow).toContain("PODMAN_SYSTEMD_UNIT");