diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5e1f46ad0..62530611c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -17,23 +17,10 @@ jobs:
     outputs:
       matrix: ${{ steps.filter.outputs.matrix }}
     steps:
-      # Plain git instead of actions/checkout: self-hosted runners on this
-      # network intermittently time out downloading action tarballs from
-      # codeload.github.com (100s HttpClient limit x3 = dead job). git fetch
-      # talks to github.com directly and needs no action download at all.
-      - name: Checkout (plain git, depth 2)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          git init -q .
-          git remote remove origin 2>/dev/null || true
-          git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
-          git fetch -q --depth 2 origin "${{ github.sha }}"
-          git checkout -q --force "${{ github.sha }}"
-          git clean -ffdq
-          # Don't leave the token in .git/config on the persistent runner workspace.
-          git remote set-url origin "https://github.com/${{ github.repository }}.git"
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
 
       - name: Determine changed services
         id: filter
@@ -116,20 +103,8 @@ jobs:
       COMPOSE_DOCKER_CLI_BUILD: "1"
 
     steps:
-      # Same rationale as detect-changes: no action download on this network.
-      - name: Checkout (plain git)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          git init -q .
-          git remote remove origin 2>/dev/null || true
-          git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
-          git fetch -q --depth 1 origin "${{ github.sha }}"
-          git checkout -q --force "${{ github.sha }}"
-          git clean -ffdq
-          # Don't leave the token in .git/config on the persistent runner workspace.
-          git remote set-url origin "https://github.com/${{ github.repository }}.git"
+      - name: Checkout
+        uses: actions/checkout@v4
 
       - name: Resolve project and build env file
         run: |