diff --git a/.gitea/workflows/terraform.yml b/.gitea/workflows/terraform.yml
index 19e2027..8de206b 100644
--- a/.gitea/workflows/terraform.yml
+++ b/.gitea/workflows/terraform.yml
@@ -53,7 +53,24 @@ jobs:
       KUBECONFIG: /workspace/.kube/config
       GIT_AUTH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout (without Node.js action)
+        run: |
+          if [ -f infrastructure.yaml ] && [ -d live ]; then
+            echo "Workspace already contains repository files, skip checkout."
+            exit 0
+          fi
+
+          TOKEN="${GIT_AUTH_TOKEN:-${GITHUB_TOKEN:-${GITEA_TOKEN:-}}}"
+          if [ -z "$TOKEN" ]; then
+            echo "No token found for git checkout (github.token/GITHUB_TOKEN/GITEA_TOKEN)."
+            exit 1
+          fi
+
+          REPO_URL="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init .
+          git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
+          git -c http.extraHeader="Authorization: token ${TOKEN}" fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout -f FETCH_HEAD
       - name: Prepare kubeconfig
         run: |
           if [ -n "${KUBECONFIG_B64:-}" ]; then
@@ -86,7 +103,24 @@ jobs:
       KUBECONFIG: /workspace/.kube/config
       GIT_AUTH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout (without Node.js action)
+        run: |
+          if [ -f infrastructure.yaml ] && [ -d live ]; then
+            echo "Workspace already contains repository files, skip checkout."
+            exit 0
+          fi
+
+          TOKEN="${GIT_AUTH_TOKEN:-${GITHUB_TOKEN:-${GITEA_TOKEN:-}}}"
+          if [ -z "$TOKEN" ]; then
+            echo "No token found for git checkout (github.token/GITHUB_TOKEN/GITEA_TOKEN)."
+            exit 1
+          fi
+
+          REPO_URL="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init .
+          git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
+          git -c http.extraHeader="Authorization: token ${TOKEN}" fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout -f FETCH_HEAD
       - name: Prepare kubeconfig
         run: |
           if [ -n "${KUBECONFIG_B64:-}" ]; then
@@ -118,7 +152,24 @@ jobs:
       KUBECONFIG: /workspace/.kube/config
       GIT_AUTH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout (without Node.js action)
+        run: |
+          if [ -f infrastructure.yaml ] && [ -d live ]; then
+            echo "Workspace already contains repository files, skip checkout."
+            exit 0
+          fi
+
+          TOKEN="${GIT_AUTH_TOKEN:-${GITHUB_TOKEN:-${GITEA_TOKEN:-}}}"
+          if [ -z "$TOKEN" ]; then
+            echo "No token found for git checkout (github.token/GITHUB_TOKEN/GITEA_TOKEN)."
+            exit 1
+          fi
+
+          REPO_URL="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init .
+          git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
+          git -c http.extraHeader="Authorization: token ${TOKEN}" fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout -f FETCH_HEAD
       - name: Prepare kubeconfig
         run: |
           if [ -n "${KUBECONFIG_B64:-}" ]; then