diff --git a/.github/actions/cargo-checks-common-setup/action.yml b/.github/actions/cargo-checks-common-setup/action.yml
index 3b50ffbd317..bdc3388ba99 100644
--- a/.github/actions/cargo-checks-common-setup/action.yml
+++ b/.github/actions/cargo-checks-common-setup/action.yml
@@ -59,6 +59,9 @@ runs:
       if: ${{ inputs.setup-sqlx-cli == 'true' }}
       uses: taiki-e/cache-cargo-install-action@34ce5120836e5f9f1508d8713d7fdea0e8facd6f # v3.0.1
       with:
-        tool: sqlx-cli
+        # Pin to match the project's sqlx 0.8.x. Unpinned resolves to sqlx-cli
+        # 0.9.0, which requires rustc 1.94+ and fails on the pinned nightly
+        # toolchain (only masked upstream by a warm cache; fresh forks fail).
+        tool: sqlx-cli@0.8.6
         no-default-features: true
         features: sqlite,postgres
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3c31b27a2a8..9be715d99ff 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -220,10 +220,14 @@ jobs:
 
   backend-remote-checks:
     needs: changes
+    # Skipped on forks: this job builds crates/remote, which depends on the
+    # private BloopAI/vibe-kanban-private `billing` crate via VK_PRIVATE_DEPLOY_KEY.
+    # Forks can't access that, so the job can never pass there.
     if: >-
       always()
       && (needs.changes.outputs['backend-remote'] == 'true' || needs.changes.result == 'skipped')
       && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+      && github.event.repository.fork == false
     runs-on: *runner_label
     env:
       SCCACHE_GHA_ENABLED: "true"
diff --git a/crates/server/src/routes/workspaces/git.rs b/crates/server/src/routes/workspaces/git.rs
index 04b27448046..fe254456af1 100644
--- a/crates/server/src/routes/workspaces/git.rs
+++ b/crates/server/src/routes/workspaces/git.rs
@@ -670,10 +670,11 @@ pub(crate) async fn rename_workspace_branch(
     for repo in &repos {
         let worktree_path = workspace_dir.join(&repo.name);
 
-        match deployment
-            .git()
-            .rename_local_branch(&worktree_path, &workspace.branch, new_branch_name)
-        {
+        match deployment.git().rename_local_branch(
+            &worktree_path,
+            &workspace.branch,
+            new_branch_name,
+        ) {
             Ok(()) => renamed_repos.push(repo),
             Err(e) => {
                 rollback_branch_renames(