diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index bb01ea1..151500a 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -42,14 +42,21 @@ jobs:
           # readme-renderer[md] is what makes `twine check` actually parse the
           # long description. Without it the render returns None and the
           # check reports PASSED regardless, even with --strict.
-          /tmp/venv/bin/pip install --quiet 'maturin[zig]' twine 'readme-renderer[md]'
+          /tmp/venv/bin/pip install 'maturin[zig]' twine 'readme-renderer[md]'
+          # The venv has to be first on PATH, not merely called by absolute
+          # path. maturin looks for zig by running `python3 -m ziglang`, and
+          # `maturin[zig]` puts ziglang in the venv only, so a bare python3
+          # resolves to the system one, which does not have it: "Failed to find
+          # zig", after apt and rustup have already run.
+          export PATH="/tmp/venv/bin:$PATH"
+          python3 -m ziglang version
           # --zig cross-compiles against an older glibc than this image ships, so
           # the wheel is not silently pinned to bookworm's.
           for target in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; do
             rustup target add "$target"
-            /tmp/venv/bin/maturin build --release --zig --target "$target" --out dist
+            maturin build --release --zig --target "$target" --out dist
           done
-          /tmp/venv/bin/maturin sdist --out dist
+          maturin sdist --out dist
           ls -l dist
 
       - name: Publish
@@ -63,8 +70,8 @@ jobs:
           TWINE_USERNAME: __token__
           TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
         run: |
-          /tmp/venv/bin/twine check --strict dist/*
+          twine check --strict dist/*
           # --skip-existing so a retry after a partial upload finishes the job
           # instead of dying on the first file. A version cannot be reused,
           # so a half-published release would otherwise burn it.
-          /tmp/venv/bin/twine upload --non-interactive --skip-existing dist/*
+          twine upload --non-interactive --skip-existing dist/*