diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index c958544..267bc41 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -24,7 +24,10 @@ jobs:
           - security              # Security suite
     
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        run: |
+          git clone $GITHUB_SERVER_URL/$GITHUB_REPOSITORY .
+          git checkout $GITHUB_SHA
       
       # Configure Attic binary cache
       - name: Configure Attic cache
@@ -32,16 +35,6 @@ jobs:
           attic login lan http://127.0.0.1:2343 ${{ secrets.ATTIC_TOKEN }}
           attic use lan:webref
       
-      # Cache Nix store for faster VM builds
-      - name: Cache Nix store
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/nix
-          key: nix-vm-${{ matrix.test }}-${{ hashFiles('flake.nix', 'flake.lock', 'nixos/tests.nix') }}
-          restore-keys: |
-            nix-vm-${{ matrix.test }}-
-            nix-vm-
-      
       # Run NixOS VM test
       - name: Run ${{ matrix.test }}
         run: |
@@ -54,15 +47,6 @@ jobs:
         if: success()
         run: |
           attic push lan:webref result
-      
-      # Archive logs on failure
-      - name: Archive test logs
-        if: failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: vm-logs-${{ matrix.test }}
-          path: result/
-          retention-days: 3
 
   # Quick checks (no VM needed)
   lint:
@@ -70,7 +54,10 @@ jobs:
     runs-on: nix
     
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        run: |
+          git clone $GITHUB_SERVER_URL/$GITHUB_REPOSITORY .
+          git checkout $GITHUB_SHA
       
       # Configure Attic cache
       - name: Configure Attic cache
@@ -78,14 +65,6 @@ jobs:
           attic login lan http://127.0.0.1:2343 ${{ secrets.ATTIC_TOKEN }}
           attic use lan:webref
       
-      # Cache node_modules for linting
-      - name: Cache node_modules
-        uses: actions/cache@v4
-        with:
-          path: frontend/node_modules
-          key: npm-${{ hashFiles('frontend/package-lock.json') }}
-          restore-keys: npm-
-      
       - name: Backend - Ruff check
         run: nix develop --command bash -c "cd backend && ruff check app/"
       
@@ -113,7 +92,10 @@ jobs:
     runs-on: nix
     
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        run: |
+          git clone $GITHUB_SERVER_URL/$GITHUB_REPOSITORY .
+          git checkout $GITHUB_SHA
       
       # Configure Attic cache
       - name: Configure Attic cache
@@ -121,21 +103,6 @@ jobs:
           attic login lan http://127.0.0.1:2343 ${{ secrets.ATTIC_TOKEN }}
           attic use lan:webref
       
-      # Cache pytest discovery
-      - name: Cache pytest
-        uses: actions/cache@v4
-        with:
-          path: backend/.pytest_cache
-          key: pytest-${{ hashFiles('backend/tests/**/*.py') }}
-      
-      # Cache node_modules
-      - name: Cache node_modules
-        uses: actions/cache@v4
-        with:
-          path: frontend/node_modules
-          key: npm-${{ hashFiles('frontend/package-lock.json') }}
-          restore-keys: npm-
-      
       - name: Backend unit tests
         run: |
           nix develop --command bash -c "
@@ -152,16 +119,6 @@ jobs:
       
       - name: Frontend unit tests
         run: nix develop --command bash -c "cd frontend && npm run test:coverage"
-      
-      - name: Upload coverage
-        uses: actions/upload-artifact@v4
-        with:
-          name: coverage-reports
-          path: |
-            backend/coverage.xml
-            backend/htmlcov/
-            frontend/coverage/
-          retention-days: 7
 
   # Verify packages build
   build:
@@ -169,7 +126,10 @@ jobs:
     runs-on: nix
     
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        run: |
+          git clone $GITHUB_SERVER_URL/$GITHUB_REPOSITORY .
+          git checkout $GITHUB_SHA
       
       # Configure Attic cache
       - name: Configure Attic cache