diff --git a/.gitea/workflows/validate.yml b/.gitea/workflows/validate.yml
index 590a7c4..f7e2fb8 100644
--- a/.gitea/workflows/validate.yml
+++ b/.gitea/workflows/validate.yml
@@ -8,7 +8,28 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    container:
+      image: node:22-bookworm
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout exact revision
+        shell: bash
+        env:
+          GITEA_ACTIONS_TOKEN: ${{ gitea.token }}
+        run: |
+          set -euo pipefail
+          test -n "$GITEA_ACTIONS_TOKEN"
+          git init .
+          git remote add origin "https://gitea.lego-cloud.eu/${{ gitea.repository }}.git"
+          git -c "http.extraHeader=Authorization: token ${GITEA_ACTIONS_TOKEN}" fetch --depth 1 origin "${{ gitea.sha }}"
+          git checkout --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "${{ gitea.sha }}"
+
       - name: Validate skill package
-        run: python3 scripts/validate_skill.py
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v python3 >/dev/null; then
+            apt-get update
+            apt-get install -y --no-install-recommends python3
+          fi
+          python3 scripts/validate_skill.py