diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index c311805..82db269 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -55,6 +55,15 @@ jobs:
     # full build runs for hours. The act_runner timeout and Gitea's
     # ENDLESS_TASK_TIMEOUT must both allow for this (see README).
     timeout-minutes: 900
+    # `docker run -v ${WORK_DIR}:/work` below talks to the runner host's docker,
+    # so it mounts the *host's* WORK_DIR. Without this bind the job container
+    # has its own private copy: the scripts it prepares never reach the build
+    # (which then ran a stale script left on the host) and the tarball the
+    # build writes is invisible to the publish steps.
+    container:
+      image: docker.gitea.com/runner-images:ubuntu-latest
+      volumes:
+        - /srv/jasp-build:/srv/jasp-build
     steps:
       - uses: actions/checkout@v4