diff --git a/.gitea/workflows/backend-quality-gate.yml b/.gitea/workflows/backend-quality-gate.yml
index 6223c778..faac9364 100644
--- a/.gitea/workflows/backend-quality-gate.yml
+++ b/.gitea/workflows/backend-quality-gate.yml
@@ -25,15 +25,20 @@ jobs:
     runs-on: xiaoxin
     timeout-minutes: 30
     steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-python@v5
-        with:
-          python-version: '3.12'
-      - uses: https://github.com/actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
+      - name: Checkout current Gitea revision
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin "${GITEA_SERVER_URL}/${GITEA_REPOSITORY}.git"
+          git fetch --no-tags origin "${GITEA_SHA}"
+          git checkout --detach "${GITEA_SHA}"
+      - name: Verify Linux runner toolchain
+        run: |
+          set -euo pipefail
+          python --version
+          node --version
+          npm --version
+          docker version
       - name: Install dependencies
         run: |
           set -euo pipefail
@@ -70,8 +75,13 @@ jobs:
       STAGING_URL: ${{ vars.STAGING_URL }}
       STAGING_KNOWN_HOSTS: ${{ vars.STAGING_KNOWN_HOSTS }}
     steps:
-      - uses: https://github.com/actions/checkout@v4
-        with: { fetch-depth: 0, persist-credentials: false }
+      - name: Checkout current Gitea revision
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin "${GITEA_SERVER_URL}/${GITEA_REPOSITORY}.git"
+          git fetch --no-tags origin main "${GITEA_SHA}"
+          git checkout --detach "${GITEA_SHA}"
       - name: Build, publish, and deploy immutable staging images
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index dd16b252..ae3eb8d3 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -384,6 +384,8 @@ test("Gitea staging push uses the xiaoxin Linux runner and immutable ACR images"
   const workflow = read(giteaQualityWorkflow);
   assert.equal(workflow.match(/runs-on: xiaoxin/g)?.length, 2);
   assert.match(workflow, /set -euo pipefail/);
+  assert.equal(workflow.match(/git fetch --no-tags origin/g)?.length, 2);
+  assert.doesNotMatch(workflow, /github\.com\/actions/);
   assert.match(workflow, /crpi-d1feco6itet73spp\.cn-hongkong\.personal\.cr\.aliyuncs\.com\/copse\/jyotisha/);
   assert.match(workflow, /secrets\.REGISTRY_USERNAME/);
   assert.match(workflow, /secrets\.REGISTRY_PASSWORD/);