diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index cfd8bf4..d9eefb2 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -15,6 +15,11 @@ env:
 jobs:
   build-deploy:
     runs-on: k8s-arm64          # act_runner label → docker:27-cli, DinD at localhost:2375
+    # The job image (docker:27-cli) is Alpine: only /bin/sh (no bash). Default all
+    # run: steps to sh so act_runner doesn't try (and fail to find) bash.
+    defaults:
+      run:
+        shell: sh
     env:
       DOCKER_HOST: tcp://localhost:2375
     steps:
@@ -29,7 +34,8 @@ jobs:
 
       - name: Short SHA
         id: sha
-        run: echo "value=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+        # POSIX sh has no ${var::7} substring — use cut.
+        run: echo "value=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)" >> "$GITHUB_OUTPUT"
 
       - name: Login to Harbor
         run: |