diff --git a/.github/workflows/ids-lint.yml b/.forgejo/workflows/ids-lint.yml
similarity index 59%
rename from .github/workflows/ids-lint.yml
rename to .forgejo/workflows/ids-lint.yml
index 2efe753..df6b3bc 100644
--- a/.github/workflows/ids-lint.yml
+++ b/.forgejo/workflows/ids-lint.yml
@@ -1,3 +1,16 @@
+# IDS compliance: every rule in every IDS/**/*.ids, against every model.
+#
+# Port of .github/workflows/ids-lint.yml. The script body is unchanged apart
+# from skipping libraries/; only the setup steps and `runs-on:` differ, because
+# ifc-ci already contains ifctester and idssplit.
+#
+# idssplit splits each IDS file into one file per rule before testing, so a
+# failure names the specific rule rather than only the specification.
+#
+# Runs on the user-scoped `ifc` runner (user ci-ifc) on hub.postle.net, whose
+# root-owned config.yaml has an empty `valid_volumes` -- no host path can be
+# mounted, which is what makes it safe for an outside contributor's PR.
+
 name: IDS Compliance Check
 
 on:
@@ -7,23 +20,19 @@ on:
 
 jobs:
   ids-lint:
-    runs-on: ubuntu-latest
+    runs-on: ifc
+    container:
+      image: hub.postle.net/bruno/ifc-ci:latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: Install ifctester and idssplit
-        run: |
-          pip install ifctester
-          pip install --no-deps https://github.com/brunopostle/idssplit/releases/download/0.1.0/idssplit-0.1.0-py3-none-any.whl
+        uses: actions/checkout@v4
 
       - name: Run IDS validations
+        # Deliberately greps output instead of trusting the exit status:
+        # ifctester's CLI has no sys.exit anywhere, so a model that violates
+        # every rule still exits 0. A naive `run: ifctester ...` would be a
+        # permanently green check that can never fail.
         run: |
           set -e
           shopt -s globstar nullglob
@@ -40,7 +49,12 @@ jobs:
             exit 0
           fi
 
-          ifc_files=(**/*.ifc)
+          # libraries/ holds vendored component sources, not deliverable models.
+          ifc_files=()
+          for f in **/*.ifc; do
+            [[ "$f" == libraries/* ]] && continue
+            ifc_files+=("$f")
+          done
 
           if [ ${#ifc_files[@]} -eq 0 ]; then
             echo "No IFC files found"
diff --git a/.forgejo/workflows/ifc-lint.yml b/.forgejo/workflows/ifc-lint.yml
new file mode 100644
index 0000000..d991afc
--- /dev/null
+++ b/.forgejo/workflows/ifc-lint.yml
@@ -0,0 +1,39 @@
+# Schema/rule validation for every IFC model in the repo.
+#
+# Port of .github/workflows/ifc-lint.yml. Only the setup steps and `runs-on:`
+# changed: `ifc-ci` already contains ifcopenshell, so there is no setup-python
+# and no pip install -- on GitHub those were most of the runtime.
+#
+# Runs on the user-scoped `ifc` runner (user ci-ifc) on hub.postle.net, whose
+# root-owned config.yaml has an empty `valid_volumes`. A job here can mount no
+# host path at all, which is what makes it safe to run an outside contributor's
+# pull request.
+
+name: IFC Validation
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint-ifc:
+    runs-on: ifc
+    container:
+      image: hub.postle.net/bruno/ifc-ci:latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run IFC lint checks
+        # Gates on its own exit status: ifcopenshell.validate calls sys.exit()
+        # on failure, so `set -e` fails the job.
+        run: |
+          set -e
+          shopt -s globstar nullglob
+          for file in **/*.ifc; do
+            # libraries/ holds vendored component sources, not deliverable models.
+            [[ "$file" == libraries/* ]] && continue
+            echo "Validating $file..."
+            python3 -m ifcopenshell.validate --rules "$file"
+          done
diff --git a/.github/workflows/ifc-lint.yml b/.github/workflows/ifc-lint.yml
deleted file mode 100644
index d6acac8..0000000
--- a/.github/workflows/ifc-lint.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: IFC Validation
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  lint-ifc:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-
-      - name: Install ifcopenshell
-        run: |
-          pip install pytest
-          pip install ifcopenshell
-
-      - name: Run IFC lint checks
-        run: |
-          set -e
-          shopt -s globstar nullglob
-          for file in **/*.ifc; do
-            echo "Validating $file..."
-            python3 -m ifcopenshell.validate --rules "$file"
-          done