diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 42c7cc3..306b1eb 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -74,8 +74,10 @@ jobs:
 
       - name: Build web (vite client + prerender)
         run: |
-          corepack enable
-          corepack prepare pnpm@10 --activate
+          # The gongfoo rust image ships node + npm but not corepack (Fedora's
+          # nodejs package omits it), and the build job runs as root — so install
+          # pnpm globally via npm. Bake pnpm into the runner image to drop this.
+          npm install -g pnpm@10
           pnpm --dir ui install --frozen-lockfile
           pnpm --dir ui run build
 
diff --git a/.gitea/workflows/refresh.yml b/.gitea/workflows/refresh.yml
index 662b3a1..4a197c1 100644
--- a/.gitea/workflows/refresh.yml
+++ b/.gitea/workflows/refresh.yml
@@ -38,8 +38,8 @@ jobs:
       - uses: actions/checkout@v4
       - name: Build web (vite client + prerender)
         run: |
-          corepack enable
-          corepack prepare pnpm@10 --activate
+          # gongfoo rust image has node + npm but not corepack; job runs as root.
+          npm install -g pnpm@10
           pnpm --dir ui install --frozen-lockfile
           pnpm --dir ui run build
       - uses: actions/upload-artifact@v3