diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 5ae96bd..5cd9a11 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -14,11 +14,9 @@ jobs:
     steps:
       - name: Clone repo
         run: |
-          echo "Workspace: $GITHUB_WORKSPACE"
           rm -rf $GITHUB_WORKSPACE/*
           git clone --depth 1 https://git.example.com/jarianc/youtube-cli $GITHUB_WORKSPACE
           git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
-          ls -la $GITHUB_WORKSPACE/
 
       - name: Install dependencies
         run: |
@@ -37,6 +35,12 @@ jobs:
     container:
       image: gitea-job-image
     steps:
+      - name: Clone repo
+        run: |
+          rm -rf $GITHUB_WORKSPACE/*
+          git clone --depth 1 https://git.example.com/jarianc/youtube-cli $GITHUB_WORKSPACE
+          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+
       - name: Install dependencies
         run: |
           python3 -m pip install --upgrade pip
@@ -52,6 +56,12 @@ jobs:
       image: gitea-job-image
       options: --privileged -v /var/run/docker.sock:/var/run/docker.sock
     steps:
+      - name: Clone repo
+        run: |
+          rm -rf $GITHUB_WORKSPACE/*
+          git clone --depth 1 https://git.example.com/jarianc/youtube-cli $GITHUB_WORKSPACE
+          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+
       - name: Build Docker image
         run: |
           docker build -t youtube-cli:test --no-cache .
@@ -61,6 +71,12 @@ jobs:
     container:
       image: gitea-job-image
     steps:
+      - name: Clone repo
+        run: |
+          rm -rf $GITHUB_WORKSPACE/*
+          git clone --depth 1 https://git.example.com/jarianc/youtube-cli $GITHUB_WORKSPACE
+          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+
       - name: Run bandit (Python SAST)
         run: |
           pip3 install bandit