diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d5ba8db..6a3a5d1 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -12,7 +12,16 @@ jobs:
     runs-on: ubuntu-latest
     container: rust:1
     steps:
-      - uses: actions/checkout@v4
+      # Plain git instead of actions/checkout: no dependence on the
+      # runner resolving external actions or injecting node into the
+      # container. Works for private repos via the workflow token.
+      - name: checkout
+        run: |
+          git init -q .
+          git fetch --depth 1 \
+            "https://gitea:${{ secrets.GITHUB_TOKEN }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
+            "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
       - name: rustfmt
         run: |
           rustup component add rustfmt
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index e7cac90..2a3fdd9 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -19,7 +19,14 @@ jobs:
       matrix:
         target: [x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu]
     steps:
-      - uses: actions/checkout@v4
+      # Plain git instead of actions/checkout — see ci.yml.
+      - name: checkout
+        run: |
+          git init -q .
+          git fetch --depth 1 \
+            "https://gitea:${{ secrets.GITHUB_TOKEN }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
+            "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
 
       - name: install tooling
         run: |
diff --git a/README.md b/README.md
index e789bc6..95aeedc 100644
--- a/README.md
+++ b/README.md
@@ -75,7 +75,8 @@ with `--no-default-features` for systems without it.
 ## Releasing
 
 ```console
-$ cargo release patch      # or minor / major — see release.toml
+$ cargo release            # tag + push the current version as-is
+$ cargo release patch      # or minor / major to bump first — release.toml
 ```
 
 This bumps the workspace version, tags `vX.Y.Z`, and pushes; the tag