diff --git a/.github/workflows/repo-stats.yml b/.github/workflows/repo-stats.yml
index e7ae33159..2c7b2f420 100644
--- a/.github/workflows/repo-stats.yml
+++ b/.github/workflows/repo-stats.yml
@@ -29,17 +29,21 @@ jobs:
         with:
           path: source
 
+      # actions/checkout@v4 was hiding the underlying git stderr behind
+      # an opaque "exit code 1" even with the same PAT jgehrcke writes
+      # gh-pages with. Direct git clone surfaces the real error if
+      # anything goes wrong and avoids the wildcard-refspec dance
+      # actions/checkout does for fetch-depth=1.
       - name: checkout-gh-pages
-        uses: actions/checkout@v4
-        with:
-          ref: gh-pages
-          path: gh-pages
-          # Same PAT jgehrcke writes gh-pages with — keeps the auth
-          # chain uniform and avoids the default GITHUB_TOKEN being
-          # rejected on fetch (root cause of the earlier "exit code 1"
-          # with no surfaced git stderr).
-          token: ${{ secrets.GHRS_GITHUB_API_TOKEN }}
-          fetch-depth: 1
+        env:
+          GH_PAT: ${{ secrets.GHRS_GITHUB_API_TOKEN }}
+        run: |
+          git clone --branch gh-pages --depth 1 \
+            "https://x-access-token:${GH_PAT}@github.com/${{ github.repository }}.git" \
+            gh-pages
+          cd gh-pages
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - name: inject-ghcr-pulls
         run: |
@@ -56,8 +60,6 @@ jobs:
             echo "no changes — skipping commit"
             exit 0
           fi
-          git config user.name  "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add maziggy/bambuddy/latest-report/report.html \
                   maziggy/bambuddy/ghcr-pulls.csv
           git commit -m "ghcr-pulls: refresh container downloads chart"