diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index fe7b1dd..a22c61a 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -1,4 +1,3 @@
-# Host-mode runner: no local Go — use official golang image + docker.sock.
 name: CI
 
 on:
@@ -22,19 +21,12 @@ jobs:
         run: |
           set -euo pipefail
           case "$GITHUB_WORKSPACE" in
-            /data/*) HOST_WORKSPACE="/opt/forgejo-runner/data${GITHUB_WORKSPACE#/data}" ;;
-            *) HOST_WORKSPACE="$GITHUB_WORKSPACE" ;;
+            /data/*) HOST_WS="/opt/forgejo-runner/data${GITHUB_WORKSPACE#/data}" ;;
+            *) HOST_WS="$GITHUB_WORKSPACE" ;;
           esac
           test -f "$GITHUB_WORKSPACE/go.mod"
+          # Single -c string so host-mode act does not split the docker command.
           docker run --rm --network host \
-            --volume "$HOST_WORKSPACE:/src" \
-            --workdir /src \
-            -e CGO_ENABLED=0 \
+            -v "${HOST_WS}:/src" -w /src -e CGO_ENABLED=0 \
             golang:1.25-bookworm \
-            bash -lc '
-              set -euo pipefail
-              go version
-              go test ./...
-              make build
-              ls -la dist/
-            '
+            sh -c "go version && go test ./... && make build && ls -la dist/"
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 823cb91..4e7d95a 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -1,4 +1,3 @@
-# Build multi-arch binaries and publish a Forgejo release on tags v*.
 name: Release
 
 on:
@@ -22,26 +21,21 @@ jobs:
         run: |
           set -euo pipefail
           case "$GITHUB_WORKSPACE" in
-            /data/*) HOST_WORKSPACE="/opt/forgejo-runner/data${GITHUB_WORKSPACE#/data}" ;;
-            *) HOST_WORKSPACE="$GITHUB_WORKSPACE" ;;
+            /data/*) HOST_WS="/opt/forgejo-runner/data${GITHUB_WORKSPACE#/data}" ;;
+            *) HOST_WS="$GITHUB_WORKSPACE" ;;
           esac
           version="${GITHUB_REF_NAME}"
-          if [[ "$version" == "main" || -z "$version" ]]; then
-            version="dev-$(echo "$GITHUB_SHA" | cut -c1-7)"
+          if [ "$version" = "main" ] || [ -z "$version" ]; then
+            version="dev-$(printf '%s' "$GITHUB_SHA" | cut -c1-7)"
           fi
+          commit="$(printf '%s' "$GITHUB_SHA" | cut -c1-7)"
           docker run --rm --network host \
-            --volume "$HOST_WORKSPACE:/src" \
-            --workdir /src \
+            -v "${HOST_WS}:/src" -w /src \
             -e CGO_ENABLED=0 \
             -e VERSION="$version" \
-            -e COMMIT="$(echo "$GITHUB_SHA" | cut -c1-7)" \
+            -e COMMIT="$commit" \
             golang:1.25-bookworm \
-            bash -lc '
-              set -euo pipefail
-              go test ./...
-              make release VERSION="$VERSION" COMMIT="$COMMIT"
-              ls -la dist/
-            '
+            sh -c 'go test ./... && make release VERSION="$VERSION" COMMIT="$COMMIT" && ls -la dist/'
 
       - name: Publish Forgejo release
         if: startsWith(github.ref, 'refs/tags/v')
@@ -51,7 +45,6 @@ jobs:
           set -euo pipefail
           tag="${GITHUB_REF_NAME}"
           api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"
-          # Create release (ignore if already exists)
           body=$(printf '%s' "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\",\"draft\":false,\"prerelease\":false}")
           resp=$(curl -sS -w "\n%{http_code}" -X POST \
             -H "Authorization: token ${TOKEN}" \
@@ -59,8 +52,7 @@ jobs:
             -d "$body" "$api" || true)
           code=$(printf '%s' "$resp" | tail -n1)
           payload=$(printf '%s' "$resp" | sed '$d')
-          if [[ "$code" != "201" && "$code" != "200" ]]; then
-            # try fetch existing
+          if [ "$code" != "201" ] && [ "$code" != "200" ]; then
             payload=$(curl -sS -H "Authorization: token ${TOKEN}" \
               "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/tags/${tag}")
           fi