diff --git a/.gitea/workflows/rebuild.yml b/.gitea/workflows/rebuild.yml
index 9f99609..580c273 100644
--- a/.gitea/workflows/rebuild.yml
+++ b/.gitea/workflows/rebuild.yml
@@ -12,11 +12,14 @@ jobs:
       - name: Qualify offline account and chat contracts before building or deploying
         run: |
           # No NAS, speech SDK, model calls or legacy live-default conftest.
-          # Read-only source mount; test secrets and databases use container /tmp.
-          docker run --rm --user "$(id -u):$(id -g)" \
+          # The socket-backed runner checkout path is not a host bind source.
+          # Stream only tracked source; secrets/runtime files are never included.
+          git archive HEAD | docker run --rm -i --user "$(id -u):$(id -g)" \
             -e HOME=/tmp -e PYTHONDONTWRITEBYTECODE=1 \
-            -v "$PWD:/src:ro" -w /src python:3.12-slim-bookworm \
-            sh -eu -c '
+            python:3.12-slim-bookworm sh -eu -c '
+              mkdir -p /tmp/src
+              tar -xf - -C /tmp/src
+              cd /tmp/src
               python -m venv /tmp/offline-tests
               /tmp/offline-tests/bin/python -m pip install --no-cache-dir pytest pytest-asyncio -r control/requirements.txt
               /tmp/offline-tests/bin/python scripts/generate_hope_themes.py --check