diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 8fac2b0..a8aa090 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -57,18 +57,36 @@ jobs:
             done
           '
 
-      - name: Run backend tests
+      - name: Ensure host Cargo cache directory exists
         run: |
           podman --remote run --rm \
-            -v "$PWD":/workspace \
-            -w /workspace \
+            -v /home/ci-service/.cache:/c \
+            alpine:3.20 sh -lc 'mkdir -p /c/cargo'
+
+      - name: Run backend tests (tar-pipe, no bind mount of source)
+        run: |
+          set -euo pipefail
+          set -o pipefail
+          tar --exclude .git --exclude target -C "$GITHUB_WORKSPACE" -cf - . | \
+          podman --remote run --rm -i \
             --network integ-${{ env.RUN_ID }} \
+            -e CARGO_HOME=/cargo \
             -e DATABASE_URL=postgres://postgres:password@test-postgres-${{ env.RUN_ID }}:5432/sharenet_test \
+            -v /home/ci-service/.cache/cargo:/cargo \
             "$RUST_IMG_DIGEST" \
-            sh -lc 'cargo test --lib -- --test-threads=1'
+            sh -euxc '
+              mkdir -p /workspace
+              tar -x -C /workspace
+              cd /workspace
+              cargo test --lib -- --test-threads=1
+            '
 
       - name: Cleanup
         if: always()
         run: |
           podman --remote rm -f test-postgres-${{ env.RUN_ID }} 2>/dev/null || true
-          podman --remote network rm integ-${{ env.RUN_ID }} 2>/dev/null || true
\ No newline at end of file
+          podman --remote network rm integ-${{ env.RUN_ID }} 2>/dev/null || true
+
+      - name: Debug DB (on failure)
+        if: failure()
+        run: podman --remote logs --tail=200 test-postgres-${{ env.RUN_ID }} || true
\ No newline at end of file