diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index cd3cbfc..b90cea9 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -25,12 +25,22 @@ jobs:
 
       - name: Verify podman socket
         run: |
-          echo "DOCKER_HOST=$DOCKER_HOST"
+          set -euo pipefail
+          echo "DOCKER_HOST=${DOCKER_HOST:-}"
+          : "${DOCKER_HOST:=unix:///var/run/docker.sock}"
+          export DOCKER_HOST CONTAINER_HOST="${CONTAINER_HOST:-$DOCKER_HOST}"
+
+          mkdir -p "${XDG_RUNTIME_DIR:-/tmp/xdg-run}" "${XDG_CONFIG_HOME:-/tmp/.config}"
+
           sock="${DOCKER_HOST#unix://}"
+          echo "Using socket: $sock"
           test -S "$sock" || { echo "missing $sock"; ls -l "$(dirname "$sock")"; exit 1; }
-          mkdir -p "${XDG_CONFIG_HOME:-/tmp/.config}/containers"
-          # Prefer explicit remote; fallback to podman-remote if that's what's installed
-          (podman --remote info || podman-remote info) | sed -n '1,80p'
+          # Prefer the remote-only binary and pass the URL explicitly
+          (if command -v podman-remote >/dev/null; then
+            podman-remote --url="$DOCKER_HOST" info
+          else
+            podman --remote --url="$DOCKER_HOST" info
+          fi) | sed -n '1,80p'
 
       - name: Verify pinned digests
         run: |