diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 1b8e964..9ac3335 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -41,15 +41,10 @@ jobs:
       SCCACHE_DIR: /var/local/sccache
       SCCACHE_SERVER_PORT: "4228"
     steps:
-      # Plain git: the aarch64 host runner has no Node.js for
-      # actions/checkout (same as uhhm/corp).
+      # v4 built-in checkout: native Go, needs no Node (the aarch64 host runner
+      # has none) and keeps the token out of a fetch URL.
       - name: Checkout
-        run: |
-          git init -q .
-          git fetch -q --depth 1 "https://ci:${{ gitea.token }}@${GITEA_SERVER#https://}/${{ gitea.repository }}.git" "${{ gitea.sha }}"
-          git checkout -q FETCH_HEAD
-        env:
-          GITEA_SERVER: ${{ gitea.server_url }}
+        uses: builtin:checkout
 
       - name: Check tag matches pkgver
         run: |