diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc2a3b8..264a13a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,14 +51,30 @@ jobs:
 
       - name: Clone poky
         run: |
-          if [ ! -d poky/.git ]; then
+          # When the cache restores an older poky and upstream has since
+          # rebased the release branch (scarthgap has done this), a plain
+          # `fetch ... ref:remote-ref` refuses the non-fast-forward update
+          # and the job dies before bitbake even starts. Force-refspec
+          # (`+ref`) makes the fetch overwrite the local tracking ref;
+          # any harder breakage (corrupt cache, repository moved) falls
+          # back to a clean re-clone.
+          set -eo pipefail
+          clone_fresh() {
+            rm -rf poky
             git clone --depth 1 --branch ${{ matrix.poky_branch }} \
               https://git.yoctoproject.org/poky poky
+          }
+          if [ ! -d poky/.git ]; then
+            clone_fresh
           else
-            git -C poky fetch --depth 1 origin \
-              ${{ matrix.poky_branch }}:refs/remotes/origin/${{ matrix.poky_branch }}
-            git -C poky checkout -B ${{ matrix.poky_branch }} \
-              refs/remotes/origin/${{ matrix.poky_branch }}
+            if ! git -C poky fetch --depth 1 origin \
+                "+${{ matrix.poky_branch }}:refs/remotes/origin/${{ matrix.poky_branch }}"; then
+              echo "fetch failed; falling back to fresh clone"
+              clone_fresh
+            else
+              git -C poky checkout -B ${{ matrix.poky_branch }} \
+                refs/remotes/origin/${{ matrix.poky_branch }}
+            fi
           fi
 
       - name: Install Yocto host dependencies
diff --git a/.github/workflows/qemu-runtime.yml b/.github/workflows/qemu-runtime.yml
index 2ae543a..46bc812 100644
--- a/.github/workflows/qemu-runtime.yml
+++ b/.github/workflows/qemu-runtime.yml
@@ -8,14 +8,13 @@ name: qemu-runtime
 #   - Weston actually started on boot
 #   - VSCode can connect to the live wayland-0 socket and stay alive
 #
-# This is heavy CI (full Yocto image build, ~1-3 hours from cold
-# sstate) so it runs weekly + on manual dispatch rather than per-PR.
+# This is heavy CI (full Yocto image build) that does NOT fit inside
+# the GitHub-hosted runner's hard 6-hour job-runtime cap from a cold
+# sstate -- repeated weekly cron runs hit the cap and got cancelled.
+# Until we wire up a self-hosted runner (e.g. fio) with persistent
+# sstate, this workflow is manual-dispatch only.
 
 on:
-  schedule:
-    # 03:17 UTC Sunday. Off-peak; small offset so cdn.kernel.org +
-    # mirrors aren't slammed alongside everyone else's nightly.
-    - cron: '17 3 * * 0'
   workflow_dispatch:
 
 # Don't pile up qemu runs if one is already in progress.
@@ -82,12 +81,25 @@ jobs:
 
       - name: Clone poky (scarthgap)
         run: |
-          if [ ! -d poky/.git ]; then
+          # See ci.yml's matching step for why this uses a force refspec
+          # plus a re-clone fallback. Upstream-branch rebases otherwise
+          # poison the cached checkout.
+          set -eo pipefail
+          clone_fresh() {
+            rm -rf poky
             git clone --depth 1 --branch scarthgap \
               https://git.yoctoproject.org/poky poky
+          }
+          if [ ! -d poky/.git ]; then
+            clone_fresh
           else
-            git -C poky fetch --depth 1 origin scarthgap:refs/remotes/origin/scarthgap
-            git -C poky checkout -B scarthgap refs/remotes/origin/scarthgap
+            if ! git -C poky fetch --depth 1 origin \
+                "+scarthgap:refs/remotes/origin/scarthgap"; then
+              echo "fetch failed; falling back to fresh clone"
+              clone_fresh
+            else
+              git -C poky checkout -B scarthgap refs/remotes/origin/scarthgap
+            fi
           fi
 
       - name: Cache downloads