diff --git a/.gitea/README.md b/.gitea/README.md
index 3681d3f..ffa0881 100644
--- a/.gitea/README.md
+++ b/.gitea/README.md
@@ -2,20 +2,24 @@
 
 [workflows](workflows/README.md) contains repository workflows.
 
-## CI checkout prerequisites
+## CI source checkout
 
 All workflows use `runs-on: ces-control`; no shared Runner configuration is changed.
-Configure repository or organization secrets `CODEX_BOT_SSH_KEY` (the dedicated
-codex-bot private SSH key) and `GITEA_SSH_KNOWN_HOSTS` (the independently verified
-known_hosts entry for `[gitea.entroia.com]:22222`). The bot needs read access to the
-repository and its Aster submodule. Workflows use an isolated SSH command with
-`-F /dev/null`, `IdentitiesOnly=yes`, an explicit key and port, strict host-key
-checking, and temporary credential files removed after checkout. Keys are never
-written into tracked files. Missing secrets fail checkout explicitly.
+`actions/checkout@v4` reads source over HTTPS using Gitea's automatically supplied
+`GITEA_TOKEN`. No additional SSH key or known_hosts secrets are required, and
+`persist-credentials: false` prevents credentials from being retained for later
+build steps.
 
-The SSH submodule URL's repository owner is separate from the authenticated bot.
-Local Git operations must use the same dedicated bot identity; configure the
-checkout's isolated command in `GIT_SSH_COMMAND` for submodule initialization.
+Consumer workflows read the exact Aster commit from the checked-out project's
+`vendor/aster` gitlink, then use another standard checkout into that directory and
+verify the resulting HEAD. They do not follow Aster main automatically. Aster is
+currently a public repository, so reading it does not require private cross-repo
+authorization. If that visibility changes, diagnose the job token's read access
+instead of assuming an SSH key must be distributed.
+
+The SSH URL in `.gitmodules` is retained for developer Git operations, which
+continue to use the dedicated codex-bot identity. CI's built-in job token is
+separate from local developer credentials.
 
 Workflow definitions do not prove CI passed. CI/deployment state is not queried
 automatically. Local runtime checks are not performed for Aster, Lyra or Hestia;
diff --git a/.gitea/workflows/README.md b/.gitea/workflows/README.md
index bf083ac..4216404 100644
--- a/.gitea/workflows/README.md
+++ b/.gitea/workflows/README.md
@@ -1,5 +1,5 @@
 # Tessera GUI workflows
 
-[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. Checkout and secret requirements are in [the parent README](../README.md).
+[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
 
 There is no production service deployment in this workflow.
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 988ea2a..9023380 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -13,35 +13,34 @@ jobs:
     env:
       DOCKER_BUILDKIT: "0"
     steps:
-      - name: Checkout with codex-bot
-        env:
-          CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }}
-          GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }}
-          SOURCE_SHA: ${{ gitea.sha }}
-          SOURCE_REPOSITORY: ${{ gitea.repository }}
+      - name: Checkout project
+        id: checkout_project
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          persist-credentials: false
+      - name: Read pinned Aster revision
+        id: aster_revision
         run: |
           set -eu
-          test -n "$CODEX_BOT_SSH_KEY"
-          test -n "$GITEA_SSH_KNOWN_HOSTS"
-          case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac
-          test "${#SOURCE_SHA}" -eq 40
-          umask 077
-          checkout_keys=$(mktemp -d)
-          trap 'rm -rf "$checkout_keys"' EXIT
-          printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key"
-          printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts"
-          unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS
-          export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts"
-          git init .
-          source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git"
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "$source_url"
-          else
-            git remote add origin "$source_url"
-          fi
-          git fetch --no-tags --depth=1 origin "$SOURCE_SHA"
-          git checkout --detach --force FETCH_HEAD
-          git submodule update --init --recursive
+          aster_sha=$(git ls-tree HEAD -- vendor/aster | awk '$1 == "160000" && $2 == "commit" && $4 == "vendor/aster" { print $3 }')
+          case "$aster_sha" in *[!0-9a-f]*|'') echo "Invalid Aster gitlink" >&2; exit 1;; esac
+          test "${#aster_sha}" -eq 40
+          printf 'sha=%s\n' "$aster_sha" >> "$GITHUB_OUTPUT"
+      - name: Checkout pinned Aster
+        id: checkout_aster
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          repository: Zayden-Jung/endorphin-aster-vm
+          ref: ${{ steps.aster_revision.outputs.sha }}
+          path: vendor/aster
+          persist-credentials: false
+      - name: Verify Aster revision
+        env:
+          EXPECTED_ASTER_SHA: ${{ steps.aster_revision.outputs.sha }}
+        run: test "$(git -C vendor/aster rev-parse HEAD)" = "$EXPECTED_ASTER_SHA"
+
       - name: Verify portable GUI code
         run: |
           image="endorphin-tessera-gui-ci:${{ gitea.sha }}"
diff --git a/README.md b/README.md
index 2798faa..724b229 100644
--- a/README.md
+++ b/README.md
@@ -105,4 +105,4 @@ There are no files, HTML, CSS, JavaScript, DOM, or resource-network concepts in
 
 ## Validation
 
-Local Cargo builds and native window runs are allowed; do not run local tests or Docker. Automated tests and Clippy run in [.gitea](.gitea/README.md) on ces-control using Dockerfile.ci. The Linux CI checks portable code and software-renderer tests, not macOS window presentation. Aster dependency unit tests remain in Aster CI. CI bot SSH secrets are documented in .gitea/README.md.
+Local Cargo builds and native window runs are allowed; do not run local tests or Docker. Automated tests and Clippy run in [.gitea](.gitea/README.md) on ces-control using Dockerfile.ci. The Linux CI checks portable code and software-renderer tests, not macOS window presentation. Aster has no standalone CI/CD; Lyra CI explicitly runs the pinned engine tests. CI uses HTTPS checkout with the built-in job token; see .gitea/README.md.
diff --git a/vendor/aster b/vendor/aster
index 55475a9..6281e58 160000
--- a/vendor/aster
+++ b/vendor/aster
@@ -1 +1 @@
-Subproject commit 55475a9d4b3948a569bf76c84041ad9cea0ec6ea
+Subproject commit 6281e5864783ed23d8959425e7c8b519b61b2105