diff --git a/.gitea/ci-image/Dockerfile b/.gitea/ci-image/Dockerfile
index 22d9d6a..fa9b11c 100644
--- a/.gitea/ci-image/Dockerfile
+++ b/.gitea/ci-image/Dockerfile
@@ -18,4 +18,10 @@ FROM condaforge/miniforge3:latest
 RUN mamba install -y -c conda-forge sage ruff pytest \
     && mamba clean -afy
 
+# actions/checkout@v4 (and other JS-based actions) run via `node` inside this
+# container -- act_runner doesn't inject a runtime of its own when a custom
+# `container:` image is set, so one has to be present here.
+RUN mamba install -y -c conda-forge nodejs \
+    && mamba clean -afy
+
 WORKDIR /workspace
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4c89a0d..a37bf3d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -29,7 +29,10 @@ jobs:
       - name: ruff check
         # --no-respect-gitignore: *.sage.py is gitignored (it's generated, see
         # the previous step) but that's exactly what we need to lint here.
-        run: sage --python -m ruff check --no-respect-gitignore .
+        # `python` here is the conda env's own interpreter -- it already has
+        # sage/ruff/pytest importable, `sage --python` isn't a real flag on
+        # the conda-forge sage CLI.
+        run: python -m ruff check --no-respect-gitignore .
 
   test:
     runs-on: ubuntu-latest
@@ -42,4 +45,4 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Run tests
-        run: sage --python -m pytest tests/
+        run: python -m pytest tests/