diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 7061ed2..5d6b708 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -7,10 +7,17 @@ on:
 
 jobs:
   build-and-push:
-    # Needs docker-in-docker: the runner's job container must have access to
-    # a docker socket (e.g. act_runner configured with
-    # -v /var/run/docker.sock:/var/run/docker.sock) for buildx to work.
     runs-on: docker
+    # The default job image has no docker CLI, so run in an image that has
+    # one and talk to a sidecar dind daemon over the network instead of
+    # relying on the runner exposing a host docker socket.
+    container: docker:27-cli
+    services:
+      docker:
+        image: docker:27-dind
+        options: --privileged
+    env:
+      DOCKER_HOST: tcp://docker:2375
     steps:
       - name: Checkout
         uses: actions/checkout@v4