diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index e57a95f..2471ba9 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -34,6 +34,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+          # The action's SARIF artifact upload uses @actions/artifact v2, which
+          # throws GHESNotSupportedError against Forgejo. The scan itself works;
+          # disable the upload so a clean scan doesn't fail the job.
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
@@ -180,7 +184,7 @@ jobs:
 
       - name: Upload screenshots on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: forgejo/upload-artifact@v4
         with:
           name: visual-snapshots-diff
           path: apps/planner/.vitest-attachments/