diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f797828d..7cc2a4d0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -2,6 +2,11 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
+# CI for the self-hosted, host-executor Podman runners (see container/).
+# The runner image bakes in the Rust toolchain and all build dependencies,
+# so jobs go straight to cargo — no apt/rustup setup steps (which also
+# collided on the dpkg lock when jobs ran concurrently in the same runner).
+
 name: CI
 
 on:
@@ -17,90 +22,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            build-essential pkg-config cmake clang libclang-dev \
-            libopus-dev libasound2-dev libsoapysdr-dev
-
-      - name: Set up Rust
-        run: |
-          export PATH="$HOME/.cargo/bin:$PATH"
-          if ! command -v rustup >/dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-              | sh -s -- -y --profile minimal
-          fi
-          rustup toolchain install stable --profile minimal \
-            --component rustfmt --component clippy
-          rustup default stable
-
-      - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: cargo-${{ runner.os }}-
-
       - name: rustfmt
-        run: |
-          export PATH="$HOME/.cargo/bin:$PATH"
-          cargo fmt --all -- --check
-
+        run: cargo fmt --all -- --check
       - name: clippy
-        run: |
-          export PATH="$HOME/.cargo/bin:$PATH"
-          cargo clippy --workspace --all-targets --all-features -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            build-essential pkg-config cmake clang libclang-dev \
-            libopus-dev libasound2-dev libsoapysdr-dev
-
-      - name: Set up Rust
-        run: |
-          export PATH="$HOME/.cargo/bin:$PATH"
-          if ! command -v rustup >/dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-              | sh -s -- -y --profile minimal
-          fi
-          rustup toolchain install stable --profile minimal
-          rustup default stable
-
-      - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: cargo-${{ runner.os }}-
-
       - name: Build
-        run: |
-          export PATH="$HOME/.cargo/bin:$PATH"
-          cargo build --workspace --all-targets --locked
-
+        run: cargo build --workspace --all-targets --locked
       - name: Test
-        run: |
-          export PATH="$HOME/.cargo/bin:$PATH"
-          cargo test --workspace --locked
+        run: cargo test --workspace --locked
 
   reuse:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - name: REUSE compliance
-        uses: fsfe/reuse-action@v5
+        # `reuse` CLI instead of fsfe/reuse-action: the latter is a Docker
+        # action, which the host-executor runners cannot run. `reuse` is baked
+        # into the runner image (see container/Containerfile).
+        run: reuse lint
diff --git a/container/Containerfile b/container/Containerfile
index 1632a08e..1e5b62ca 100644
--- a/container/Containerfile
+++ b/container/Containerfile
@@ -32,7 +32,9 @@ RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
     && rm -rf /var/lib/apt/lists/*
 
 # REUSE >= 3 (Debian's packaged reuse is too old for REUSE.toml).
-RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install reuse
+# The [charset-normalizer] extra provides an encoding-detection backend;
+# without it (and without libmagic) reuse fails to import at runtime.
+RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install 'reuse[charset-normalizer]'
 
 # Rust stable with rustfmt + clippy, installed system-wide.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \