diff --git a/workflows/container-build-push-multirepo.yaml b/workflows/container-build-push-multirepo.yaml
index 3fbda0b..8d0d599 100644
--- a/workflows/container-build-push-multirepo.yaml
+++ b/workflows/container-build-push-multirepo.yaml
@@ -33,28 +33,35 @@ jobs:
         run: |
           set -eu
           REF="${GITHUB_SHA:-main}"
+          SHORT="${REF:0:7}"
           mkdir -p buildctx "${HOME}/bin"
+          # Forgejo archive endpoint accepts short SHA; full SHA can hang.
           wget -qO /tmp/primary.tar.gz \
-            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
           tar xzf /tmp/primary.tar.gz -C buildctx --strip-components=1
-          BUILD_ARGS=()
           for spec in ${EXTRA_REPOS}; do
             repo="${spec%@*}"
             ctx="${spec#*@}"
-            extra_ref="${REF}"
+            # Extra repos track their own main branch; primary SHA is not valid there.
+            extra_ref="main"
             wget -qO "/tmp/${ctx}.tar.gz" \
               "https://forgejo.coulomb.social/${repo}/archive/${extra_ref}.tar.gz"
             mkdir -p "/tmp/ctx-${ctx}"
             tar xzf "/tmp/${ctx}.tar.gz" -C "/tmp/ctx-${ctx}" --strip-components=1
-            BUILD_ARGS+=(--build-context "${ctx}=/tmp/ctx-${ctx}")
           done
+          # Runner DinD has legacy docker (no buildx); vendor first extra repo into context.
+          mkdir -p buildctx/_hub_core_src
+          cp -r /tmp/ctx-hub_core_src/pyproject.toml /tmp/ctx-hub_core_src/hub_core buildctx/_hub_core_src/
+          sed \
+            -e 's|COPY --from=hub_core_src pyproject.toml|COPY _hub_core_src/pyproject.toml|' \
+            -e 's|COPY --from=hub_core_src hub_core/|COPY _hub_core_src/hub_core/|' \
+            buildctx/Dockerfile > buildctx/Dockerfile.ci
           wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
             | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
-          SHORT="${REF:0:7}"
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build "${BUILD_ARGS[@]}" \
+          docker build -f buildctx/Dockerfile.ci \
             -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:main-${SHORT}"