diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 32e16d9..a3c9e4f 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -116,9 +116,10 @@ jobs:
 
     steps:
       # checkout@v4 without git falls back to a REST API tarball download that
-      # Forgejo does not serve, failing with a bare 404.
+      # Forgejo does not serve (404); without ca-certificates git cannot verify
+      # the forge's TLS certificate ("CAfile: none").
       - name: Install git
-        run: apt-get update && apt-get install -y --no-install-recommends git
+        run: apt-get update && apt-get install -y --no-install-recommends git ca-certificates
 
       - uses: https://data.forgejo.org/actions/checkout@v4