diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index e42ce98..150342b 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -13,12 +13,33 @@ jobs:
       REGISTRY: gitea.dataprovider01.sandbox-cat-dat.simpl-europe.eu
       IMAGE_REPO: gitea.dataprovider01.sandbox-cat-dat.simpl-europe.eu/j.r/template-code-location
     steps:
-      - name: Validate workspace
+      - name: Checkout repository (shell)
         run: |
-          pwd
-          ls -la
-          if [ ! -f "Dockerfile" ]; then
-            echo "Dockerfile not found in workspace. Configure runner to provide repository checkout."
+          REPO_DIR="repo"
+          SERVER_URL="${GITHUB_SERVER_URL:-$GITEA_SERVER_URL}"
+          TOKEN="${GITHUB_TOKEN:-$GITEA_TOKEN}"
+          REF_NAME="${GITHUB_REF_NAME}"
+          if [ -z "${REF_NAME}" ]; then
+            REF_NAME="${GITHUB_REF#refs/heads/}"
+          fi
+
+          if [ -z "${SERVER_URL}" ]; then
+            echo "Missing GITHUB_SERVER_URL/GITEA_SERVER_URL"
+            exit 1
+          fi
+
+          if [ -z "${TOKEN}" ]; then
+            echo "Missing GITHUB_TOKEN/GITEA_TOKEN; cannot clone private repository"
+            exit 1
+          fi
+
+          rm -rf "${REPO_DIR}"
+          git clone --depth 1 --branch "${REF_NAME}" \
+            "https://oauth2:${TOKEN}@${SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
+            "${REPO_DIR}"
+
+          if [ ! -f "${REPO_DIR}/Dockerfile" ]; then
+            echo "Dockerfile not found after clone"
             exit 1
           fi
 
@@ -38,6 +59,7 @@ jobs:
         run: |
           COMMIT_SHA="${GITHUB_SHA:-$GITEA_SHA}"
           SHORT_SHA="$(echo "${COMMIT_SHA}" | cut -c1-12)"
+          cd repo
           docker build \
             -t "${IMAGE_REPO}:latest" \
             -t "${IMAGE_REPO}:${SHORT_SHA}" \