diff --git a/.forgejo/workflows/grade.yml b/.forgejo/workflows/grade.yml
index a1afe88..775cc07 100644
--- a/.forgejo/workflows/grade.yml
+++ b/.forgejo/workflows/grade.yml
@@ -2,27 +2,25 @@ name: grade
 on: [push]
 
 # Production wiring (forgejo-runner on ghost):
-#   - forgejo-runner v13 config: docker_host: automount -> the job container
-#     gets the host docker socket, so `docker run` drives the host daemon
-#   - the nested grade container mounts the secret + hidden tests straight from
-#     the host (/opt/grade/grade.env, /opt/grade-hidden/...) — never in this
-#     repo, no job-container options, no Actions secrets required
-#   - checkout uses Forgejo's native action (data.forgejo.org), required for
-#     forgejo-runner v13
+#   - the job container IS the grade image (grade-c:dev on the host daemon),
+#     so the harness runs directly — no nested docker, no node-dependent actions
+#   - the workflow clones the repo itself with Forgejo's built-in token
+#     (GITHUB_TOKEN / FORGEJO_TOKEN) — the automatic token has read access
+#   - runner.yaml mounts /opt/grade-hidden + /opt/grade/grade.env into every
+#     job container (host paths, never in this repo)
 jobs:
   grade:
     runs-on: docker
     container:
-      image: gitea/runner-images:ubuntu-22.04
+      image: grade-c:dev
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
       - name: Grade (blank fails, solved passes)
         run: |
-          docker run --rm --network=none \
-            -v "$PWD":/work \
-            -v /opt/grade/grade.env:/run/secrets/grade.env:ro \
-            -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
-            -v /opt/grade/runner-diag:/diag \
-            grade-c:dev \
-            sh -c 'set -a; . /run/secrets/grade.env; set +a; echo "SECRET_LEN=${#GRADE_HMAC_SECRET}"; python3 /opt/grade/grade_cli.py run --student /work --hidden /hidden --course CS2060 --assignment record-manager --out /work/results.json 2>&1 | tee /diag/latest.log'
-          python3 -c "import json; d=json.load(open('results.json'))['result']; print('VERDICT ok=', d['ok'], 'public=', d['tests']['public'], 'hidden=', d['tests']['hidden'])"
+          rm -rf /tmp/work && mkdir -p /tmp/work && cd /tmp/work
+          git clone -q --depth 1 "https://x:${GITHUB_TOKEN:-$FORGEJO_TOKEN}@git.trevon.dev/${GITHUB_REPOSITORY}.git" .
+          set -a; . /run/secrets/grade.env; set +a
+          python3 /opt/grade/grade_cli.py run \
+            --student . --hidden /opt/grade-hidden/cs2060/record-manager \
+            --course CS2060 --assignment record-manager \
+            --out results.json 2>&1 | tee /opt/grade/runner-diag/latest.log || true
+          python3 -c "import json,sys; d=json.load(open('results.json'))['result']; print('VERDICT ok=', d['ok'], 'public=', d['tests']['public'], 'hidden=', d['tests']['hidden']); sys.exit(0 if d['ok'] else 1)"