diff --git a/action.yml b/action.yml
index 250a8c8..9587cae 100644
--- a/action.yml
+++ b/action.yml
@@ -48,16 +48,33 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Setup Node (stdlib only)
-      uses: actions/setup-node@v4
-      with:
-        node-version: "20"
+    # Do not uses: actions/setup-node — many Gitea forges have no mirror (404).
+    # Runner image / consumer workflow must provide Node >= 18.
+    - name: Require Node.js
+      shell: bash
+      run: |
+        if ! command -v node >/dev/null 2>&1; then
+          echo "::error::Node.js >= 18 required for Gatekeep (merge-findings.js / publish.js)."
+          echo "Preinstall Node on the runner, or add a mirrored setup-node step before uses: ./."
+          exit 1
+        fi
+        node --version
 
+    # PEP 668 blocks pip --user on many runners; use a workspace venv instead.
     - name: Install PyYAML (providers.yaml)
       shell: bash
       run: |
-        python3 -m pip install --user pyyaml -q
-        python3 -c "import yaml; print('pyyaml ok', yaml.__version__)"
+        if python3 -c "import yaml" 2>/dev/null; then
+          python3 -c "import yaml; print('pyyaml ok', yaml.__version__)"
+          exit 0
+        fi
+        VENV="${{ github.workspace }}/.gatekeep/.venv"
+        mkdir -p "$(dirname "$VENV")"
+        python3 -m venv "$VENV"
+        "$VENV/bin/pip" install -q pyyaml
+        echo "$VENV/bin" >> "$GITHUB_PATH"
+        echo "VIRTUAL_ENV=$VENV" >> "$GITHUB_ENV"
+        "$VENV/bin/python" -c "import yaml; print('pyyaml ok', yaml.__version__)"
 
     - name: Discover entry points
       id: discover
diff --git a/scripts/review.sh b/scripts/review.sh
index 74ef3f1..9916899 100644
--- a/scripts/review.sh
+++ b/scripts/review.sh
@@ -176,11 +176,14 @@ set -e
 
 META=$(cat "$OUT/merge-meta.json")
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-  python3 -c 'import json,os,sys
-m=json.loads(sys.argv[1])
-open(os.environ["GITHUB_OUTPUT"],"a").write(
-  f"risk_tier={m[\"risk_tier\"]}\nsecurity_blocking={str(m[\"security_blocking\"]).lower()}\nagreed_count={m[\"agreed_count\"]}\n"
-)' "$META"
+  python3 - "$META" <<'PY'
+import json, os, sys
+m = json.loads(sys.argv[1])
+with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
+    fh.write(f"risk_tier={m['risk_tier']}\n")
+    fh.write(f"security_blocking={str(m['security_blocking']).lower()}\n")
+    fh.write(f"agreed_count={m['agreed_count']}\n")
+PY
 fi
 
 exit "$pub_ec"