diff --git a/.forgejo/workflows/publish-image.yaml b/.forgejo/workflows/publish-image.yaml
index dab1656..fbe7c68 100644
--- a/.forgejo/workflows/publish-image.yaml
+++ b/.forgejo/workflows/publish-image.yaml
@@ -53,19 +53,24 @@ jobs:
           tar xzf "${BUILD_ROOT}/policy-nexus.tar.gz" \
             -C "${BUILD_CONTEXT}" --strip-components=1
 
-          python3 "${BUILD_CONTEXT}/tools/fetch_sources.py" \
-            --config "${BUILD_CONTEXT}/source-inventory.config.json" \
-            --destination "${BUILD_CONTEXT}/_sources" \
-            --policy-revision "${REF}"
-          NETKINGDOM_REVISION="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["repositories"]["net-kingdom"]["revision"])' "${BUILD_CONTEXT}/_sources/source-lock.json")"
-          SOURCE_SET_DIGEST="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["source_set_digest"])' "${BUILD_CONTEXT}/_sources/source-lock.json")"
-          SOURCE_TAG="source-${SOURCE_SET_DIGEST}"
-          REVISION_TAG="git-${REF}-sources-${SOURCE_SET_DIGEST:0:16}"
-
           wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
             | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
           docker version
+          PYTHON_IMAGE="docker.io/library/python@sha256:d09d15e60962ca365d1cd544a48773bac9d33f2fb1b00f2aa0deec78ade7dc31"
+          docker run --rm \
+            --volume "${BUILD_CONTEXT}:/workspace" \
+            --workdir /workspace \
+            "${PYTHON_IMAGE}" \
+            python3 tools/fetch_sources.py \
+              --config source-inventory.config.json \
+              --destination _sources \
+              --policy-revision "${REF}"
+          NETKINGDOM_REVISION="$(docker run --rm --volume "${BUILD_CONTEXT}:/workspace" "${PYTHON_IMAGE}" python3 -c 'import json; print(json.load(open("/workspace/_sources/source-lock.json"))["repositories"]["net-kingdom"]["revision"])')"
+          SOURCE_SET_DIGEST="$(docker run --rm --volume "${BUILD_CONTEXT}:/workspace" "${PYTHON_IMAGE}" python3 -c 'import json; print(json.load(open("/workspace/_sources/source-lock.json"))["source_set_digest"])')"
+          SOURCE_TAG="source-${SOURCE_SET_DIGEST}"
+          REVISION_TAG="git-${REF}-sources-${SOURCE_SET_DIGEST:0:16}"
+
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
             -u "${REGISTRY_USER}" --password-stdin
 
diff --git a/tools/fetch_sources.py b/tools/fetch_sources.py
index 9ee269a..14ed102 100644
--- a/tools/fetch_sources.py
+++ b/tools/fetch_sources.py
@@ -7,20 +7,22 @@ import argparse
 import hashlib
 import json
 from pathlib import Path, PurePosixPath
-import subprocess
 import tarfile
 import tempfile
+import urllib.parse
 import urllib.request
 
 
 def _revision(remote: str, branch: str) -> str:
-    result = subprocess.run(
-        ["git", "ls-remote", remote, f"refs/heads/{branch}"],
-        check=True,
-        capture_output=True,
-        text=True,
-    )
-    revision = result.stdout.split(maxsplit=1)[0] if result.stdout.strip() else ""
+    parsed = urllib.parse.urlparse(remote)
+    parts = parsed.path.removesuffix(".git").strip("/").split("/")
+    if parsed.scheme != "https" or len(parts) != 2:
+        raise ValueError(f"unsupported Forgejo remote {remote!r}")
+    owner, repo = (urllib.parse.quote(part, safe="") for part in parts)
+    branch_name = urllib.parse.quote(branch, safe="")
+    url = f"{parsed.scheme}://{parsed.netloc}/api/v1/repos/{owner}/{repo}/branches/{branch_name}"
+    with urllib.request.urlopen(url, timeout=30) as response:
+        revision = json.load(response).get("commit", {}).get("id", "")
     if len(revision) != 40 or any(char not in "0123456789abcdef" for char in revision):
         raise ValueError(f"{remote}: could not resolve a clean 40-hex {branch} revision")
     return revision