diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index cf69641..a86c0f2 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -62,10 +62,12 @@ jobs:
       - uses: actions/checkout@v4
       # The runner image lacks pip, and a semgrep job-container lacks the node that
       # actions/checkout needs — so install pip via apt on the standard image.
+      # Gitea's Act runner has no sudo binary but already runs as root, so call
+      # apt-get directly; pip install --user needs no pipx.
       - name: Install semgrep
         run: |
-          sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip pipx
-          pipx install semgrep
+          apt-get update -qq && apt-get install -y -qq python3-pip
+          python3 -m pip install --user --break-system-packages semgrep || python3 -m pip install --user semgrep
       - name: Semgrep scan
         run: |
           export PATH="$HOME/.local/bin:$PATH"