diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index d3c653a..e3ad7fc 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -78,23 +78,33 @@ jobs:
   migrate:
     needs: build-and-push
     runs-on: ubuntu-latest
-    container:
-      image: mcr.microsoft.com/dotnet/sdk:8.0
+    # Checkout/setup-* are Node actions and must run on the job host (act_runner
+    # default image). Do not set job-level container: — that replaced the host
+    # with dotnet/sdk (no node) and broke checkout. Use docker run for the SDK
+    # instead; the runner already needs Docker for build-and-push.
     steps:
       - uses: actions/checkout@v4
 
       - name: Build migration bundle
         run: |
-          dotnet tool install --global dotnet-ef --version 8.0.4 \
-            || dotnet tool update --global dotnet-ef --version 8.0.4
-          export PATH="$PATH:/root/.dotnet/tools"
-          bash ./scripts/build-api-migration-bundle.sh
+          docker run --rm \
+            -v "$PWD:/src" \
+            -w /src \
+            -e HOME=/tmp \
+            mcr.microsoft.com/dotnet/sdk:8.0 \
+            bash -euo pipefail -c '
+              dotnet tool install --global dotnet-ef --version 8.0.4 \
+                || dotnet tool update --global dotnet-ef --version 8.0.4
+              export PATH="$PATH:/tmp/.dotnet/tools"
+              bash ./scripts/build-api-migration-bundle.sh
+            '
           cp -f ./artifacts/migrate-api ./migrate-api
           chmod +x ./migrate-api
 
       # Runs while the previous release is still serving traffic, so every
       # migration must be backwards-compatible with the outgoing image.
       # See Step 6 — expand-then-contract.
+      # Self-contained linux-x64 binary — runs on the host, not inside the SDK image.
       - name: Apply migrations
         run: ./migrate-api --connection "${{ secrets.PG_CONNECTION_DDL }}"