diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 46a63b0..6aa6fc2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -10,21 +10,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        with:
-          # Pinned to a 9.x release that predates pnpm's strict
-          # ERR_PNPM_IGNORED_BUILDS gate (added in 9.15 / 10.x). With
-          # `version: 9` the action was resolving to a newer release that
-          # blocks the install over our onlyBuiltDependencies allowlist not
-          # being honored in this runner. 9.14.4 just runs the scripts the
-          # way pnpm always did, which matches what the Dockerfiles do via
-          # corepack `pnpm@9` and what production builds rely on.
-          version: "9.14.4"
-
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: pnpm
+
+      - name: Set up pnpm via corepack
+        # pnpm/action-setup@v4 was ignoring its `version` input on this
+        # runner and always installing latest pnpm 10.x, which blocked the
+        # install with ERR_PNPM_IGNORED_BUILDS no matter how we configured
+        # onlyBuiltDependencies. Install pnpm 9.14.4 via corepack instead
+        # — same mechanism the Dockerfiles use, no strict-build gate, runs
+        # postinstall scripts the way pnpm has for years.
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.14.4 --activate
+          pnpm --version
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -50,21 +50,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        with:
-          # Pinned to a 9.x release that predates pnpm's strict
-          # ERR_PNPM_IGNORED_BUILDS gate (added in 9.15 / 10.x). With
-          # `version: 9` the action was resolving to a newer release that
-          # blocks the install over our onlyBuiltDependencies allowlist not
-          # being honored in this runner. 9.14.4 just runs the scripts the
-          # way pnpm always did, which matches what the Dockerfiles do via
-          # corepack `pnpm@9` and what production builds rely on.
-          version: "9.14.4"
-
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: pnpm
+
+      - name: Set up pnpm via corepack
+        # pnpm/action-setup@v4 was ignoring its `version` input on this
+        # runner and always installing latest pnpm 10.x, which blocked the
+        # install with ERR_PNPM_IGNORED_BUILDS no matter how we configured
+        # onlyBuiltDependencies. Install pnpm 9.14.4 via corepack instead
+        # — same mechanism the Dockerfiles use, no strict-build gate, runs
+        # postinstall scripts the way pnpm has for years.
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.14.4 --activate
+          pnpm --version
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile