diff --git a/.forgejo/workflows/verify.yaml b/.forgejo/workflows/verify.yaml
index a8ebe71..d4fb5f8 100644
--- a/.forgejo/workflows/verify.yaml
+++ b/.forgejo/workflows/verify.yaml
@@ -32,19 +32,21 @@ jobs:
           rustup target add x86_64-unknown-linux-musl
 
       - name: Setup additional tooling
-        run: .forgejo/workflows/setup-tools.sh
+        run: |
+          .forgejo/workflows/setup-tools.sh
+          git config --add safe.directory "$PWD"
 
       - name: Build
-        run: just build
+        run: just ci build
 
       - name: Format
-        run: just format-assess
+        run: just ci format-assess
       - name: Lint
-        run: just lint-assess
+        run: just ci lint-assess
       - name: Cargo check
-        run: just check
+        run: just ci check
       - name: Test
-        run: just test
+        run: just ci test
       - name: Assess test coverage
-        run: just cover-assess
+        run: just ci cover-assess
 
diff --git a/.justfile b/.justfile
index 14705dd..6dc9ac6 100644
--- a/.justfile
+++ b/.justfile
@@ -433,6 +433,12 @@ default:
 choose:
     @just --choose
 
+[script, private]
+ci recipe:
+    id -u ci >/dev/null 2>&1 || useradd -m ci
+    chown -R ci:ci .
+    su ci -c "just {{ recipe }}"
+
 alias ch := choose
 
 export CARGO_TERM_COLOR := 'always'
diff --git a/Cargo.lock b/Cargo.lock
index 87d028d..d5037d8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -854,9 +854,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
 dependencies = [
  "ring",
  "rustls-pki-types",
diff --git a/src/router/handlers/fixed.rs b/src/router/handlers/fixed.rs
index 770d139..390e794 100644
--- a/src/router/handlers/fixed.rs
+++ b/src/router/handlers/fixed.rs
@@ -724,7 +724,7 @@ mod tests {
     }
 
     #[test]
-    fn not_found_fallback_error() {
+    fn not_found_asset_error() {
         let error = fallback("not_found.png", &Graph::default()).unwrap_err();
 
         assert!(matches!(&error.kind, AssetErrorKind::NotFound));
@@ -736,6 +736,7 @@ mod tests {
 }
 
 #[cfg(test)]
+#[cfg(unix)]
 #[expect(clippy::panic_in_result_fn)]
 mod serial_tests {
     use std::{fs, os::unix::fs::PermissionsExt as _};
@@ -755,6 +756,9 @@ mod serial_tests {
         permissions.set_mode(0o200);
         fs::set_permissions(&file, permissions)?;
 
+        let new_permissions = fs::metadata(&file)?.permissions();
+        assert_eq!(new_permissions.mode() & 0o777, 0o200);
+
         let error = fallback("unreadable.png", &Graph::default()).unwrap_err();
 
         assert!(matches!(&error.kind, AssetErrorKind::IO));