diff --git a/.gitea/workflows/security-scan.yml b/.gitea/workflows/security-scan.yml
index 4c7bc27..7fe5625 100644
--- a/.gitea/workflows/security-scan.yml
+++ b/.gitea/workflows/security-scan.yml
@@ -33,32 +33,8 @@ jobs:
     name: Security Scan
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout sources
-        # Deliberately NOT actions/checkout: git fetch over HTTPS is broken on
-        # this Gitea instance since 2026-08-12. `git upload-pack --stateless-rpc`
-        # aborts with BUG("packfile_uris requires sideband-all") in upload-pack.c
-        # and dumps core on every fetch, so any git-based checkout fails before
-        # the scan even starts. Reproducible on every repo, every client, and on
-        # git 2.52 as well as 2.55 — SSH and the web UI are unaffected.
-        #
-        # Semgrep and Trivy only need the working tree, not history, so we pull
-        # the source archive over plain HTTP instead. Swap this back to
-        # actions/checkout once the upstream fetch path works again.
-        env:
-          TOKEN: ${{ github.token }}
-          # On pull_request the merge SHA may not be archivable, use the head.
-          REF: ${{ github.event.pull_request.head.sha || github.sha }}
-          SERVER: ${{ github.server_url }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -eu
-          echo "Fetching archive for $REPO @ $REF"
-          curl -sfL --retry 3 --retry-delay 5 \
-            -H "Authorization: token $TOKEN" \
-            "$SERVER/$REPO/archive/$REF.tar.gz" -o /tmp/source.tar.gz
-          tar xzf /tmp/source.tar.gz --strip-components=1
-          rm -f /tmp/source.tar.gz
-          echo "Extracted $(find . -type f | wc -l) files"
+      - name: Checkout
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v6