diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index fcbe1c1..2d10812 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -18,14 +18,17 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Install core + server + dev deps
+      - name: Install core + server + dev deps (in venv)
         run: |
+          python -m venv .venv
+          . .venv/bin/activate
           python -m pip install --upgrade pip
           python -m pip install -e ./packages/core
           python -m pip install -e "./packages/server[dev]"
 
       - name: Run pytest (server)
         run: |
+          . .venv/bin/activate
           cd packages/server
           pytest -q --maxfail=1
 
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index a907977..4f687b4 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -17,8 +17,10 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Install + test
+      - name: Install + test (in venv, isolated from hosted tool cache)
         run: |
+          python -m venv .venv
+          . .venv/bin/activate
           python -m pip install --upgrade pip
           python -m pip install -e ./packages/core
           python -m pip install -e "./packages/server[dev]"
@@ -59,7 +61,6 @@ jobs:
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
-        id: docker_build
         with:
           context: .
           push: true