diff --git a/.forgejo/workflows/build-iso.yml b/.forgejo/workflows/build-iso.yml
index fde92a1..55454ef 100644
--- a/.forgejo/workflows/build-iso.yml
+++ b/.forgejo/workflows/build-iso.yml
@@ -16,20 +16,19 @@ jobs:
   build-iso:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    # Attach the job container to `forgejo-runner_default` so the
+    # `docker-in-docker` hostname (the DinD sidecar) is DNS-resolvable.
+    # Without this the job runs on its own per-job network and DOCKER_HOST
+    # resolves nowhere. catthehacker/ubuntu:act-latest already ships
+    # docker CLI, so we don't need to apt-install anything.
+    container:
+      image: catthehacker/ubuntu:act-latest
+      options: --network forgejo-runner_default
     env:
-      # forgejo-runner's DinD sidecar is reachable over TCP on the
-      # `forgejo-runner_default` docker network. The default runner image
-      # for `ubuntu-latest` doesn't propagate the runner's docker_host
-      # config into the job env, so we pin it explicitly here.
       DOCKER_HOST: tcp://docker-in-docker:2375
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install docker CLI
-        run: |
-          apt-get update -qq
-          apt-get install -y --no-install-recommends docker.io
-
       - name: Build ISO
         run: ./iso/build.sh
 
diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 26eb7cb..4b7dbfa 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -53,7 +53,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Check markdown links
-        uses: lycheeverse/lychee-action@v2
+        # Fully-qualified URL because forgejo's default action mirror
+        # (data.forgejo.org) doesn't carry lycheeverse/lychee-action.
+        uses: https://github.com/lycheeverse/lychee-action@v2
         with:
           args: --verbose --no-progress --max-concurrency 4 './**/*.md'
           fail: false