diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index f7b6282..bb9dfa8 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -35,13 +35,15 @@ jobs:
 
     steps:
       - name: Check out source and submodules
-        uses: https://gitea.com/actions/checkout@v4
+        # Self-hosted mirror of https://github.com/actions/checkout.
+        uses: https://code.brunner.ninja/actions/checkout@v4
         with:
           submodules: recursive
           fetch-depth: 1
 
       - name: Restore compiler and Gradle caches
-        uses: https://gitea.com/actions/cache@v4
+        # Self-hosted mirror of https://github.com/actions/cache.
+        uses: https://code.brunner.ninja/actions/cache@v4
         with:
           path: |
             .ccache
@@ -120,7 +122,8 @@ jobs:
             bash ci/build-android.sh
 
       - name: Upload Linux build
-        uses: https://gitea.com/actions/upload-artifact@v4
+        # Self-hosted mirror of https://github.com/actions/upload-artifact.
+        uses: https://code.brunner.ninja/actions/upload-artifact@v4
         with:
           name: evcharger-linux
           path: dist/linux/
@@ -128,7 +131,7 @@ jobs:
           retention-days: 30
 
       - name: Upload Android APK and AAB
-        uses: https://gitea.com/actions/upload-artifact@v4
+        uses: https://code.brunner.ninja/actions/upload-artifact@v4
         with:
           name: evcharger-android
           path: dist/android/
diff --git a/.gitmodules b/.gitmodules
index ffb426d..3c82260 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,12 +1,12 @@
 [submodule "3rdparty/qmsgpack"]
 	path = 3rdparty/qmsgpack
-	url = https://github.com/0xFEEDC0DE64/qmsgpack.git
+	url = ../qmsgpack.git
 [submodule "3rdparty/QtZeroConf"]
 	path = 3rdparty/QtZeroConf
-	url = https://github.com/0xFEEDC0DE64/QtZeroConf.git
+	url = ../QtZeroConf.git
 [submodule "3rdparty/qrcode-svg"]
 	path = 3rdparty/qrcode-svg
-	url = https://github.com/papnkukn/qrcode-svg.git
+	url = ../../papnkukn/qrcode-svg.git
 [submodule "3rdparty/Bcrypt.cpp"]
 	path = 3rdparty/Bcrypt.cpp
-	url = https://github.com/hilch/Bcrypt.cpp.git
+	url = ../../hilch/Bcrypt.cpp.git
diff --git a/docs/gitea-actions.md b/docs/gitea-actions.md
index 040083a..9bbb524 100644
--- a/docs/gitea-actions.md
+++ b/docs/gitea-actions.md
@@ -17,6 +17,24 @@ runner—pull that image and skip the image build. Bump the `rN` suffix of
 `BUILD_IMAGE` in the workflow whenever the Dockerfile toolchain changes. Tags
 are treated as immutable; never reuse an existing revision for changed content.
 
+## Self-hosted Actions
+
+The workflow does not fetch Actions from gitea.com or GitHub. Its action
+implementations are mirrored on `code.brunner.ninja` and use their local `v4`
+tags:
+
+- `actions/checkout`;
+- `actions/cache`;
+- `actions/upload-artifact`.
+
+The tags are resolved entirely through the local mirrors. Do not change these
+references back to upstream URLs. This command audits all workflow action
+references:
+
+```sh
+rg '^[[:space:]]*uses:' .gitea/workflows
+```
+
 Documentation-only commits do not start this workflow. Source, build-system,
 toolchain, tag, and manually dispatched runs continue to build the application.