diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4f60259..bd43524 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -12,17 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     container: rust:1
     steps:
-      # Not the checkout action: it runs on node, which the rust:1 job
-      # container doesn't have and this runner doesn't inject (the v5
-      # run died with 'exec: "node": not found'). Plain git needs
-      # neither, and the token URL works against the private repo.
+      # v4 built-in checkout: native Go, needs no Node (rust:1 has none) and
+      # keeps the token out of a fetch URL. Uses the job token for the private repo.
       - name: checkout
-        run: |
-          git init -q .
-          git fetch --depth 1 \
-            "https://gitea:${{ secrets.GITHUB_TOKEN }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
-            "$GITHUB_SHA"
-          git checkout -q FETCH_HEAD
+        uses: builtin:checkout
       - name: rustfmt
         run: |
           rustup component add rustfmt
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 6ae8e08..b215dca 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -19,17 +19,10 @@ jobs:
       matrix:
         target: [x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu]
     steps:
-      # Not the checkout action: it runs on node, which the rust:1 job
-      # container doesn't have and this runner doesn't inject (the v5
-      # run died with 'exec: "node": not found'). Plain git needs
-      # neither, and the token URL works against the private repo.
+      # v4 built-in checkout: native Go, needs no Node (rust:1 has none) and
+      # keeps the token out of a fetch URL. Uses the job token for the private repo.
       - name: checkout
-        run: |
-          git init -q .
-          git fetch --depth 1 \
-            "https://gitea:${{ secrets.GITHUB_TOKEN }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
-            "$GITHUB_SHA"
-          git checkout -q FETCH_HEAD
+        uses: builtin:checkout
 
       - name: install tooling
         run: |