diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index d6207139..d165efb3 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -24,7 +24,17 @@ jobs:
 
       - name: Install Docker CLI
         run: |
-          apt-get update && apt-get install -y docker.io
+          # Dodge apt entirely — the runner image's bookworm repos have been
+          # failing GPG verification with "At least one invalid signature".
+          # The static Docker client binary talks to the host's daemon socket
+          # that act_runner mounts into the job container, which is all we
+          # need for `docker build` / `docker push`.
+          curl -fsSL -o /tmp/docker.tgz \
+            https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz
+          tar xzf /tmp/docker.tgz -C /tmp
+          install -m 0755 /tmp/docker/docker /usr/local/bin/docker
+          rm -rf /tmp/docker /tmp/docker.tgz
+          docker --version
 
       - name: Generate image tag
         id: tag