diff --git a/.gitea/workflows/discover-windows.yml b/.gitea/workflows/discover-windows.yml
index fddb32f..f5854eb 100644
--- a/.gitea/workflows/discover-windows.yml
+++ b/.gitea/workflows/discover-windows.yml
@@ -50,21 +50,32 @@ jobs:
       # (`../continuum-schemas`, `../continuum-common`), so all three are laid
       # out side by side inside the workspace - the checkout action will not
       # place a repo outside it, which is why the proxy is in a subdirectory
-      # rather than at the root. The siblings are taken from the same branch
-      # name as this one: the proxy's code needs their unreleased commits.
+      # rather than at the root.
       - uses: actions/checkout@v4
         with:
           path: continuum-proxy
-      - uses: actions/checkout@v4
-        with:
-          repository: Continuum/continuum-schemas
-          ref: ${{ github.ref_name }}
-          path: continuum-schemas
-      - uses: actions/checkout@v4
-        with:
-          repository: Continuum/continuum-common
-          ref: ${{ github.ref_name }}
-          path: continuum-common
+
+      # Plain git for the siblings, not a second `actions/checkout`: on this
+      # Windows runner a second use of the action in one job fails syncing the
+      # action's own cached clone ("...\.git\objects\pack\...idx: Access is
+      # denied", run 413). Same branch name as this one, because the proxy's
+      # code needs their unreleased commits. The job's token goes in a header
+      # for the clone and is never written to a remote URL or a log.
+      - name: Check out the sibling repositories
+        shell: powershell
+        working-directory: .
+        env:
+          CI_TOKEN: ${{ github.token }}
+          CI_SERVER: ${{ github.server_url }}
+          CI_BRANCH: ${{ github.ref_name }}
+        run: |
+          $auth = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("x-access-token:$($env:CI_TOKEN)"))
+          foreach ($repo in @("continuum-schemas", "continuum-common")) {
+            if (Test-Path $repo) { Remove-Item -Recurse -Force $repo }
+            git -c "http.extraheader=AUTHORIZATION: basic $auth" clone --quiet --depth 1 --branch $env:CI_BRANCH "$($env:CI_SERVER)/Continuum/$repo.git" $repo
+            if ($LASTEXITCODE -ne 0) { throw "could not clone $repo at branch $($env:CI_BRANCH)" }
+            Write-Host "$repo at $(git -C $repo rev-parse --short HEAD)"
+          }
 
       - name: Install the Rust MSVC toolchain
         shell: powershell