diff --git a/.gitea/workflows/firmware-release-build.yml b/.gitea/workflows/firmware-release-build.yml
index ea418ad..1340dfd 100644
--- a/.gitea/workflows/firmware-release-build.yml
+++ b/.gitea/workflows/firmware-release-build.yml
@@ -13,16 +13,21 @@ on:
 
 jobs:
   build-and-release:
+    # Deliberately NOT a job-level `container: espressif/idf:...` -- that
+    # image has no Node.js in it, and actions/checkout (like most marketplace
+    # actions) is a Node action that gets exec'd *inside* whatever container
+    # the job specifies, so checkout fails immediately with "node: not
+    # found" (hit this on the first real run). Checkout instead runs on the
+    # plain runner (which has Node), and only the two build steps below
+    # spin up the ESP-IDF image themselves via `docker run` -- the runner
+    # already bind-mounts the host's docker socket, so docker-in-docker
+    # works fine from an ordinary run: step (same mechanism the existing
+    # server-docker-build.yml relies on for docker buildx).
     runs-on: ubuntu-latest
-    container:
-      image: espressif/idf:release-v5.3
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Trust the checkout (container user differs from the checkout's owner)
-        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
-
       - name: Read firmware version
         id: version
         run: echo "version=$(tr -d '[:space:]' < firmware/version.txt)" >> "$GITHUB_OUTPUT"
@@ -33,19 +38,28 @@ jobs:
       # generated sdkconfig so this never fights over shared state.
       # set-target first since a fresh checkout has no cached sdkconfig
       # (firmware/sdkconfig* is gitignored, see firmware/.gitignore).
+      # safe.directory guards against git's "dubious ownership" check,
+      # since the container runs as root over a volume owned by the
+      # runner's host user; idf.py shells out to git for component/
+      # version bookkeeping even though the embedded app version itself
+      # comes from version.txt, not git describe.
       - name: Build (devkit -- ESP32-C6-DevKitC-1)
         run: |
-          . "$IDF_PATH/export.sh"
-          cd firmware
-          ./build_for_board.sh devkit set-target esp32c6
-          ./build_for_board.sh devkit build
+          docker run --rm -v "$PWD:/workspace" -w /workspace/firmware espressif/idf:release-v5.3 bash -c '
+            git config --global --add safe.directory /workspace &&
+            . "$IDF_PATH/export.sh" &&
+            ./build_for_board.sh devkit set-target esp32c6 &&
+            ./build_for_board.sh devkit build
+          '
 
       - name: Build (xiao -- Seeed XIAO ESP32-C6)
         run: |
-          . "$IDF_PATH/export.sh"
-          cd firmware
-          ./build_for_board.sh xiao set-target esp32c6
-          ./build_for_board.sh xiao build
+          docker run --rm -v "$PWD:/workspace" -w /workspace/firmware espressif/idf:release-v5.3 bash -c '
+            git config --global --add safe.directory /workspace &&
+            . "$IDF_PATH/export.sh" &&
+            ./build_for_board.sh xiao set-target esp32c6 &&
+            ./build_for_board.sh xiao build
+          '
 
       - name: Collect binaries
         run: |