diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6c6bd39..5bb9a26 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -89,7 +89,8 @@ jobs:
       - name: Build and push
         run: |
           # Nur linux/amd64: einziger Konsument ist der LXC auf x86.
-          SHA_TAG="git.42i.org/spine/llmrouter:sha-${GITHUB_SHA:0:7}"
+          # POSIX, kein bash-Slice: die Job-Shell ist sh -e.
+          SHA_TAG="git.42i.org/spine/llmrouter:sha-$(printf '%.7s' "$GITHUB_SHA")"
           docker buildx build \
             --builder "${BUILDER}" \
             --platform linux/amd64 \