diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 2eee8b6..89d5a1d 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -10,16 +10,16 @@ env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
   RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
 
 jobs:
   ci:
     name: Linux x86_64 (Forgejo)
     runs-on: ubuntu-latest
     steps:
-      # See fai/platform docs/architecture/ci.md for why we
-      # check out via the external URL instead of using
-      # actions/checkout.
-      - name: Checkout via external URL
+      # Manual external-URL checkout — see fai/platform CI for
+      # background. Lays this repo at $GITHUB_WORKSPACE.
+      - name: Checkout text-extract via external URL
         run: |
           set -eu
           mkdir -p "$GITHUB_WORKSPACE"
@@ -30,6 +30,23 @@ jobs:
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout -q FETCH_HEAD
 
+      # The fai-module-sdk dependency is a git dep against a repo
+      # that lives in another Forgejo org. The repo-scoped
+      # GITHUB_TOKEN cannot read it, and the Forgejo instance has
+      # REQUIRE_SIGNIN_VIEW=true so anonymous read is also denied.
+      # MODULE_SDK_PAT is a stored secret with read access to
+      # fai/module-sdk; we inject it into any outgoing
+      # https://git.flemming.ws/ URL via insteadOf so cargo's git
+      # fetch (driven by CARGO_NET_GIT_FETCH_WITH_CLI) authenticates
+      # transparently.
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
+            "https://git.flemming.ws/"
+
       - name: Install system dependencies
         run: |
           apt-get update -qq
@@ -56,13 +73,13 @@ jobs:
         run: cargo fmt --all -- --check
 
       - name: Cargo clippy
-        run: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --all-targets -- -D warnings
 
       - name: Cargo build (host)
-        run: cargo build --workspace --all-targets
+        run: cargo build --all-targets
 
       - name: Cargo test (host)
-        run: cargo test --workspace --all-targets
+        run: cargo test --all-targets
 
       - name: Cargo build (wasm32-wasip2)
         run: cargo build --release --target wasm32-wasip2
diff --git a/Cargo.toml b/Cargo.toml
index 6f0614c..f2f99cc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@
 
 [package]
 name = "orchestrator_llm"
-version = "0.3.1"
+version = "0.3.2"
 edition = "2024"
 authors = ["Dr. Stefan Flemming <platform@flemming.ai>"]
 license = "Apache-2.0"