diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml
index 5b671bd..a95c9a4 100644
--- a/.forgejo/workflows/test.yml
+++ b/.forgejo/workflows/test.yml
@@ -11,16 +11,25 @@ jobs:
   test:
     runs-on: ubuntu-latest
     container:
-      image: catthehacker/ubuntu:act-22.04
+      # 22.04 ships Python 3.10, which cannot install the pinned Django (it
+      # needs >= 3.12). While requirements.txt still said "django>=4.2" that
+      # went unnoticed and pip quietly resolved a 4.x here — so CI was testing
+      # a different Django than the image actually shipped. 24.04 gives us
+      # 3.12, matching the Dockerfile's python:3.12-slim.
+      image: catthehacker/ubuntu:act-24.04
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Python dependencies
-        run: pip install --no-cache-dir -r requirements.txt
+        # 24.04 marks its system Python as externally managed (PEP 668), so a
+        # bare `pip install` is refused. A venv is the sanctioned way in.
+        run: |
+          python -m venv /tmp/venv
+          /tmp/venv/bin/pip install --no-cache-dir -r requirements.txt
 
       - name: Django system check
-        run: python manage.py check
+        run: /tmp/venv/bin/python manage.py check
 
       - name: Run tests
-        run: python manage.py test
+        run: /tmp/venv/bin/python manage.py test