diff --git a/.gitea/workflows/reskin.yaml b/.gitea/workflows/reskin.yaml
index bd650e6..acae017 100644
--- a/.gitea/workflows/reskin.yaml
+++ b/.gitea/workflows/reskin.yaml
@@ -2,12 +2,10 @@ name: anubis-reskin
 on:
   schedule: [{ cron: '17 6 * * *' }]
   workflow_dispatch:
-
 env:
   UPSTREAM: TecharoHQ/anubis
   IMAGE: git.kernel.rip/sesh/anubis
   REGISTRY: git.kernel.rip
-
 jobs:
   reskin:
     runs-on: ubuntu-latest
@@ -15,27 +13,24 @@ jobs:
       - name: Latest upstream tag
         id: up
         run: echo "tag=$(curl -fsSL https://api.github.com/repos/$UPSTREAM/releases/latest | jq -r .tag_name)" >>"$GITHUB_OUTPUT"
-
       - uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ secrets.REG_USER }}
           password: ${{ secrets.REG_TOKEN }}
-
       - name: Skip if already built
         id: check
         run: |
           docker manifest inspect "$IMAGE:${{ steps.up.outputs.tag }}" >/dev/null 2>&1 \
             && echo "build=false" >>"$GITHUB_OUTPUT" \
             || echo "build=true" >>"$GITHUB_OUTPUT"
-
       - if: steps.check.outputs.build == 'true'
         uses: actions/checkout@v4                    # overlay repo
-
       - if: steps.check.outputs.build == 'true'
-        uses: actions/checkout@v4
-        with: { repository: "${{ env.UPSTREAM }}", ref: "${{ steps.up.outputs.tag }}", path: upstream }
-
+        name: Checkout upstream at tag
+        run: |
+          git clone --depth 1 --branch "${{ steps.up.outputs.tag }}" \
+            https://github.com/TecharoHQ/anubis.git upstream
       - if: steps.check.outputs.build == 'true'
         name: Overlay + drift guard
         run: |
@@ -43,7 +38,6 @@ jobs:
             test -f "upstream/web/static/img/$f.webp" || { echo "::error::missing $f.webp upstream"; exit 1; }
           done
           cp mascot/*.webp upstream/web/static/img/
-
       - if: steps.check.outputs.build == 'true'
         working-directory: upstream
         run: |