diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b77476d..20282c3 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,8 +1,9 @@
 # CI for shopdb-flask.
 #
-# NOTE: this is a best-effort configuration. Gitea Actions availability on
-# the host is UNVERIFIED - no runner has been confirmed. Until a runner is
-# registered and this workflow is observed passing, treat it as config-only.
+# The Gitea runner executes jobs on the host (act host executor), so
+# actions/setup-python cannot provision interpreters (no prebuilt binaries
+# for the host distro). The backend job uses the system python3 in a venv
+# instead. setup-node works because node is resolved differently.
 #
 # Three jobs run on push and pull_request:
 #   backend  - pytest (tests use in-memory SQLite via TestingConfig, so no
@@ -22,16 +23,14 @@ jobs:
     steps:
       - name: Check out
         uses: actions/checkout@v4
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements.txt
+          python3 --version
+          python3 -m venv .venv
+          .venv/bin/pip install --upgrade pip
+          .venv/bin/pip install -r requirements.txt
       - name: Run backend tests
-        run: python -m pytest
+        run: .venv/bin/python -m pytest
 
   naming:
     runs-on: ubuntu-latest