diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 903f328..1325bfa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,11 +20,13 @@ jobs:
       # and drops a subpath such as /git (actions/checkout#1370, #1242), so it
       # cannot clone from imsc.uni-graz.at/git. ischanx/checkout keeps the path.
       # Pinned to the commit of its v6.0.2 tag; its v4 tags lack the fix.
-      - uses: ischanx/checkout@b3a7a36c84c480d7e1a6f9f7ca7bb55dc519f0ba # v6.0.2
-      - uses: pnpm/action-setup@v4
+      # Actions use full GitHub URLs: short names resolve against the
+      # instance's default actions registry, not GitHub.
+      - uses: https://github.com/ischanx/checkout@b3a7a36c84c480d7e1a6f9f7ca7bb55dc519f0ba # v6.0.2
+      - uses: https://github.com/pnpm/action-setup@v4
         with:
           version: 11
-      - uses: actions/setup-node@v4
+      - uses: https://github.com/actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           cache: pnpm
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 78095e2..81f6933 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -95,3 +95,7 @@ and drops the `/git` subpath of imsc.uni-graz.at, so cloning fails
 The fork's v6.0.2 tag fixes that; its v4 tags are identical to upstream and
 do not. The action is pinned to a commit hash because it runs with the CI
 token. When upgrading, review the fork's diff against upstream first.
+
+All actions are referenced by full URL (`uses: https://github.com/...`).
+Short names like `actions/setup-node@v4` would be looked up in the
+instance's default actions registry instead of on GitHub.