diff --git a/.gitea/workflows/security-scan.yml b/.gitea/workflows/security-scan.yml
index 7fe5625..4c7bc27 100644
--- a/.gitea/workflows/security-scan.yml
+++ b/.gitea/workflows/security-scan.yml
@@ -33,8 +33,32 @@ jobs:
     name: Security Scan
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
+      - name: Checkout sources
+        # Deliberately NOT actions/checkout: git fetch over HTTPS is broken on
+        # this Gitea instance since 2026-08-12. `git upload-pack --stateless-rpc`
+        # aborts with BUG("packfile_uris requires sideband-all") in upload-pack.c
+        # and dumps core on every fetch, so any git-based checkout fails before
+        # the scan even starts. Reproducible on every repo, every client, and on
+        # git 2.52 as well as 2.55 — SSH and the web UI are unaffected.
+        #
+        # Semgrep and Trivy only need the working tree, not history, so we pull
+        # the source archive over plain HTTP instead. Swap this back to
+        # actions/checkout once the upstream fetch path works again.
+        env:
+          TOKEN: ${{ github.token }}
+          # On pull_request the merge SHA may not be archivable, use the head.
+          REF: ${{ github.event.pull_request.head.sha || github.sha }}
+          SERVER: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -eu
+          echo "Fetching archive for $REPO @ $REF"
+          curl -sfL --retry 3 --retry-delay 5 \
+            -H "Authorization: token $TOKEN" \
+            "$SERVER/$REPO/archive/$REF.tar.gz" -o /tmp/source.tar.gz
+          tar xzf /tmp/source.tar.gz --strip-components=1
+          rm -f /tmp/source.tar.gz
+          echo "Extracted $(find . -type f | wc -l) files"
 
       - name: Set up Python
         uses: actions/setup-python@v6