diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index fc89229..56a3fbf 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -13,7 +13,20 @@ jobs:
       image: golang:1.24-bookworm
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          git init .
+          if [ -n "${TOKEN:-}" ]; then
+            server="${GITHUB_SERVER_URL#https://}"
+            server="${server#http://}"
+            git remote add origin "https://x-access-token:${TOKEN}@${server}/${GITHUB_REPOSITORY}.git"
+          else
+            git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          fi
+          git fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout --detach FETCH_HEAD
 
       - name: Check formatting
         run: |
diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 18e1a4a..689890f 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -6,14 +6,27 @@ on:
       - main
 
 jobs:
-  build-push:
-    name: Test, build, and push image
+  lint-test:
+    name: Lint and test
     runs-on: ubuntu-latest
     container:
       image: golang:1.24-bookworm
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          git init .
+          if [ -n "${TOKEN:-}" ]; then
+            server="${GITHUB_SERVER_URL#https://}"
+            server="${server#http://}"
+            git remote add origin "https://x-access-token:${TOKEN}@${server}/${GITHUB_REPOSITORY}.git"
+          else
+            git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          fi
+          git fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout --detach FETCH_HEAD
 
       - name: Check formatting
         run: |
@@ -30,6 +43,29 @@ jobs:
       - name: Test
         run: go test ./...
 
+  build-push:
+    name: Build and push image
+    runs-on: ubuntu-latest
+    needs: lint-test
+    container:
+      image: docker:27-git
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          git init .
+          if [ -n "${TOKEN:-}" ]; then
+            server="${GITHUB_SERVER_URL#https://}"
+            server="${server#http://}"
+            git remote add origin "https://x-access-token:${TOKEN}@${server}/${GITHUB_REPOSITORY}.git"
+          else
+            git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          fi
+          git fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout --detach FETCH_HEAD
+
       - name: Read version
         run: |
           version="$(tr -d '[:space:]' < VERSION)"