diff --git a/.gitea/workflows/ci-cd.yaml b/.gitea/workflows/ci-cd.yaml
index 216efe7..e9ed28a 100644
--- a/.gitea/workflows/ci-cd.yaml
+++ b/.gitea/workflows/ci-cd.yaml
@@ -10,34 +10,22 @@ jobs:
   i18n-check:
     name: i18n Catalog Check
     runs-on: ubuntu-latest
+    container: node:22-bookworm
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
       - name: Install Bun
         run: |
-          if ! command -v unzip >/dev/null; then
-            (command -v apt-get >/dev/null && apt-get update && apt-get install -y unzip) || \
-            (command -v apk >/dev/null && apk add --no-cache unzip)
-          fi
-          arch=$(uname -m)
-          case "$arch" in x86_64) target=x64 ;; aarch64|arm64) target=aarch64 ;; *) echo "unsupported arch: $arch"; exit 1 ;; esac
-          # musl images (Alpine) need the -musl build; the glibc one fails with spawn ENOENT
-          libc=""
-          if ldd --version 2>&1 | grep -qi musl; then libc="-musl"; fi
-          curl -fsSL -o /tmp/bun.zip "https://github.com/oven-sh/bun/releases/latest/download/bun-linux-${target}${libc}.zip"
-          unzip -q -o /tmp/bun.zip -d /tmp/bun-extract
-          mkdir -p "$HOME/.bun/bin"
-          mv /tmp/bun-extract/bun-linux-*/bun "$HOME/.bun/bin/bun"
-          chmod +x "$HOME/.bun/bin/bun"
-          echo "$HOME/.bun/bin" >> $GITHUB_PATH
-          "$HOME/.bun/bin/bun" --version
+          npm install -g bun
+          bun --version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
       - name: Catalogs in sync with source
         run: |
+          git config --global --add safe.directory "$(pwd)"
           bunx lingui extract --clean
           git diff --exit-code src/locales || {
             echo "::error::Locale catalogs are stale — run 'bun run extract' and commit src/locales"