diff --git a/.gitea/workflows/security-audit.yml b/.gitea/workflows/security-audit.yml
index 2a66c19..34f2fb7 100644
--- a/.gitea/workflows/security-audit.yml
+++ b/.gitea/workflows/security-audit.yml
@@ -16,7 +16,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install the reviewed cargo-audit release
-        run: cargo install cargo-audit --locked --version 0.22.2
+        uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af # v2
+        with:
+          tool: cargo-audit@0.22.2
+          fallback: none
 
       - name: Reject new RustSec vulnerabilities
-        run: cargo audit --ignore RUSTSEC-2023-0071
+        # Invoke the prebuilt binary directly: the runner has no Cargo toolchain.
+        # The existing RSA exception is documented in docs/ssh-transport-audit.md.
+        run: cargo-audit audit --ignore RUSTSEC-2023-0071
diff --git a/crates/storage/tests/ssh_release_audit.rs b/crates/storage/tests/ssh_release_audit.rs
index 08044c0..5c093ca 100644
--- a/crates/storage/tests/ssh_release_audit.rs
+++ b/crates/storage/tests/ssh_release_audit.rs
@@ -20,8 +20,10 @@ fn release_feature_and_advisory_boundaries_stay_explicit() {
     }
     assert!(APPLE_MANIFEST.contains("default-features = false, features = [\"full\"]"));
     assert!(!APPLE_MANIFEST.contains("features = [\"ssh\"]"));
-    assert!(AUDIT_WORKFLOW.contains("cargo-audit --locked --version 0.22.2"));
-    assert!(AUDIT_WORKFLOW.contains("cargo audit --ignore RUSTSEC-2023-0071"));
+    assert!(AUDIT_WORKFLOW.contains("tool: cargo-audit@0.22.2"));
+    assert!(AUDIT_WORKFLOW.contains("fallback: none"));
+    assert!(!AUDIT_WORKFLOW.contains("cargo install"));
+    assert!(AUDIT_WORKFLOW.contains("run: cargo-audit audit --ignore RUSTSEC-2023-0071"));
     assert!(AUDIT.contains("RUSTSEC-2023-0071"));
 }