diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0a641c1..dd1cd2a 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -124,15 +124,17 @@ jobs:
     # Self-hosted windev runner (10.100.0.48): the only host that can build the x86 / net48 Worker
     # and MXAccess-adjacent code. Not required for a green portable build; runs where a runner exists.
     runs-on: [self-hosted, windows]
+    # act host-mode on Windows can't stage JS actions and its pwsh shim dot-sources a relative
+    # path that pwsh rejects; run everything through cmd and check out with plain git instead.
+    defaults:
+      run:
+        shell: cmd
     steps:
-      # act host-mode on Windows cannot stage JS actions (actions/checkout's dist/ is not
-      # materialized), so check the repo out manually. Public repo -> anonymous https clone.
       - name: Checkout (manual)
-        shell: pwsh
         run: |
           git init -q .
-          git remote add origin "https://gitea.dohertylan.com/$env:GITHUB_REPOSITORY"
-          git -c protocol.version=2 fetch -q --depth 1 origin $env:GITHUB_SHA
+          git remote add origin https://gitea.dohertylan.com/%GITHUB_REPOSITORY%
+          git -c protocol.version=2 fetch -q --depth 1 origin %GITHUB_SHA%
           git checkout -q --force FETCH_HEAD
       - name: Build x86 Worker
         run: dotnet build src/ZB.MOM.WW.MxGateway.Worker/ZB.MOM.WW.MxGateway.Worker.csproj -p:Platform=x86
@@ -145,14 +147,16 @@ jobs:
     runs-on: [self-hosted, windows, mxaccess]
     env:
       MXGATEWAY_RUN_LIVE_MXACCESS_TESTS: '1'
+    # Same act host-mode constraint as the windows job above.
+    defaults:
+      run:
+        shell: cmd
     steps:
-      # Manual checkout — same act host-mode constraint as the windows job above.
       - name: Checkout (manual)
-        shell: pwsh
         run: |
           git init -q .
-          git remote add origin "https://gitea.dohertylan.com/$env:GITHUB_REPOSITORY"
-          git -c protocol.version=2 fetch -q --depth 1 origin $env:GITHUB_SHA
+          git remote add origin https://gitea.dohertylan.com/%GITHUB_REPOSITORY%
+          git -c protocol.version=2 fetch -q --depth 1 origin %GITHUB_SHA%
           git checkout -q --force FETCH_HEAD
       - name: Live MXAccess smoke
         run: dotnet test src/ZB.MOM.WW.MxGateway.IntegrationTests/ZB.MOM.WW.MxGateway.IntegrationTests.csproj --filter FullyQualifiedName~WorkerLiveMxAccessSmokeTests