diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 1dd64f2..eeb4031 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -8,16 +8,20 @@ on:
 permissions:
   contents: write
 
+# Self-contained: no external (GitHub-hosted) actions. Runs on a self-hosted
+# Windows runner (label `windows`) that already has Python 3.12 on PATH.
 jobs:
   build:
     runs-on: windows
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
+      - name: Checkout repository at tag
+        shell: pwsh
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          $base = "${{ github.server_url }}" -replace '^https://', ''
+          $url  = "https://oauth2:$env:TOKEN@$base/${{ github.repository }}.git"
+          git clone --depth 1 --branch "$env:GITHUB_REF_NAME" $url .
 
       - name: Install build dependencies
         run: python -m pip install --upgrade pip pyinstaller rich