diff --git a/.gitea/workflows/tests.yml b/.gitea/workflows/tests.yml
index 09ff9f5..c953304 100644
--- a/.gitea/workflows/tests.yml
+++ b/.gitea/workflows/tests.yml
@@ -27,12 +27,12 @@ jobs:
           coverage: none
 
       - name: Install PHP dependencies
-        # Dist downloads come from GitHub, which rate-limits anonymous callers —
-        # on a shared IP that is a coin flip. Falling back to source clones keeps
-        # CI self-sufficient instead of depending on someone else's quota.
-        run: |
-          composer install --no-interaction --prefer-dist --no-progress \
-            || composer install --no-interaction --prefer-source --no-progress
+        # Source clones, not dist archives: dist downloads go through GitHub's
+        # API, which throttles anonymous callers and left a half-installed
+        # vendor/ behind — the tests then failed with 500s that had nothing to
+        # do with the code. Cloning is slower and does not need anyone's quota.
+        # Swap back to --prefer-dist once a GitHub token is configured.
+        run: composer install --no-interaction --prefer-source --no-progress
 
       - name: Prepare environment
         run: |