diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7cb4547..dca3504 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -9,15 +9,15 @@ jobs:
     runs-on: ubuntu-latest
     container: rust:latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Cache cargo registry/target
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+      # Plain git rather than actions/checkout: that is a JavaScript action,
+      # and rust:latest has no `node`, so it failed with exit 127 before any
+      # code was built — on every push. actions/cache went for the same reason.
+      - name: Check out
+        run: |
+          git init -q .
+          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          for i in 1 2 3; do git fetch -q --depth 1 origin "${GITHUB_SHA}" && break; sleep 5; done
+          git checkout -q FETCH_HEAD
       - name: Install rustfmt & clippy components
         run: rustup component add rustfmt clippy
       - name: Install thumbv7em-none-eabihf target
@@ -28,7 +28,9 @@ jobs:
         # dependency a failure (CLAWHDF5_REQUIRE_INTEROP below).
         run: |
           apt-get update
-          apt-get install -y --no-install-recommends python3 python3-venv
+          # cmake builds libz-ng-sys (clawhdf5-format's default `fast-deflate`);
+          # rust:latest does not ship it.
+          apt-get install -y --no-install-recommends python3 python3-venv cmake
           python3 -m venv /opt/interop
           /opt/interop/bin/pip install --no-cache-dir h5py numpy netCDF4 xarray
           echo "/opt/interop/bin" >> "$GITHUB_PATH"
@@ -73,6 +75,19 @@ jobs:
           command -v rustup >/dev/null || curl -sSf --retry 5 https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain none
           rustup toolchain install stable --profile minimal --component clippy
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      - name: Build dependencies
+        # libz-ng-sys (clawhdf5-format's default `fast-deflate`) needs cmake.
+        # In the Docker runner the job is root and can install it; a host
+        # runner cannot, so say what is missing rather than fail inside a
+        # build script.
+        run: |
+          if command -v cmake >/dev/null; then cmake --version | head -1; exit 0; fi
+          if [ "$(id -u)" = 0 ]; then
+            apt-get update -qq && apt-get install -y -qq cmake
+          else
+            echo "::error::cmake is not installed on this runner host (needed by libz-ng-sys)"
+            exit 1
+          fi
       - name: Confirm aarch64
         run: |
           test "$(uname -m)" = aarch64