diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index abd8e25..6b0caae 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -19,7 +19,8 @@ jobs:
         run: |
           rm -rf $GITHUB_WORKSPACE/*
           git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
-          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+          git -C $GITHUB_WORKSPACE fetch --depth 1 origin $GITHUB_SHA 2>/dev/null || true
+          git -C $GITHUB_WORKSPACE checkout FETCH_HEAD 2>/dev/null || git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
 
       - name: Run ruff (Python lint)
         if: always()
@@ -50,7 +51,8 @@ jobs:
         run: |
           rm -rf $GITHUB_WORKSPACE/*
           git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
-          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+          git -C $GITHUB_WORKSPACE fetch --depth 1 origin $GITHUB_SHA 2>/dev/null || true
+          git -C $GITHUB_WORKSPACE checkout FETCH_HEAD 2>/dev/null || git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
 
       - name: Run pytest (Python)
         if: always()
@@ -90,7 +92,8 @@ jobs:
         run: |
           rm -rf $GITHUB_WORKSPACE/*
           git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
-          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+          git -C $GITHUB_WORKSPACE fetch --depth 1 origin $GITHUB_SHA 2>/dev/null || true
+          git -C $GITHUB_WORKSPACE checkout FETCH_HEAD 2>/dev/null || git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
 
       - name: Build Docker images
         if: always()
@@ -121,7 +124,8 @@ jobs:
         run: |
           rm -rf $GITHUB_WORKSPACE/*
           git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
-          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+          git -C $GITHUB_WORKSPACE fetch --depth 1 origin $GITHUB_SHA 2>/dev/null || true
+          git -C $GITHUB_WORKSPACE checkout FETCH_HEAD 2>/dev/null || git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
 
       - name: Run bandit (Python SAST)
         if: always()