diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 28271aa..28ab19e 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -10,6 +10,8 @@ jobs:
   build:
     name: Build ostree packages
     runs-on: ubuntu-latest
+    container:
+      image: debian:unstable
     permissions:
       contents: read
       packages: write
@@ -33,23 +35,19 @@ jobs:
           # Quick check with timeout to avoid hanging
           if timeout 10 curl -s --connect-timeout 5 http://192.168.1.101:3142/acng-report.html > /dev/null 2>&1; then
             echo "✅ apt-cacher-ng is available, configuring proxy sources..."
-            echo "deb http://192.168.1.101:3142/ftp.debian.org/debian unstable main" | sudo tee /etc/apt/sources.list.d/debian-unstable.list
-            echo "deb-src http://192.168.1.101:3142/ftp.us.debian.org/debian unstable main" | sudo tee -a /etc/apt/sources.list.d/debian-unstable.list
+            echo "deb http://192.168.1.101:3142/ftp.debian.org/debian unstable main" > /etc/apt/sources.list
+            echo "deb-src http://192.168.1.101:3142/ftp.us.debian.org/debian unstable main" >> /etc/apt/sources.list
           else
             echo "⚠️ apt-cacher-ng not available, using standard Debian mirrors..."
-            echo "deb http://deb.debian.org/debian unstable main" | sudo tee /etc/apt/sources.list.d/debian-unstable.list
-            echo "deb-src http://deb.debian.org/debian unstable main" | sudo tee -a /etc/apt/sources.list.d/debian-unstable.list
+            echo "deb http://deb.debian.org/debian unstable main" > /etc/apt/sources.list
+            echo "deb-src http://deb.debian.org/debian unstable main" >> /etc/apt/sources.list
           fi
 
-          # Add Debian keyring
-          sudo apt update
-          sudo apt install -y debian-archive-keyring
-          
           # Update package lists
-          sudo apt update -y
+          apt update -y
 
           # Install essential build tools
-          sudo apt install -y build-essential fakeroot devscripts curl git
+          apt install -y build-essential fakeroot devscripts curl git
 
       - name: Clone ostree from Debian sid
         run: |
@@ -65,9 +63,9 @@ jobs:
         run: |
           echo "Installing build dependencies..."
           cd /tmp/ostree-*
-          sudo mk-build-deps -i -t 'apt-get -y' debian/control || echo "mk-build-deps failed, continuing..."
-          sudo apt-get update
-          sudo apt-get build-dep -y . || echo "Build deps installation failed, continuing..."
+          mk-build-deps -i -t 'apt-get -y' debian/control || echo "mk-build-deps failed, continuing..."
+          apt-get update
+          apt-get build-dep -y . || echo "Build deps installation failed, continuing..."
 
       - name: Add backport revision number
         run: |