diff --git a/.gitea/workflows/disk-audit.yml b/.gitea/workflows/disk-audit.yml
index 9bd7bc65..47ef40f6 100644
--- a/.gitea/workflows/disk-audit.yml
+++ b/.gitea/workflows/disk-audit.yml
@@ -5,13 +5,19 @@ jobs:
   audit:
     runs-on: nixos
     steps:
-      - name: filesystem audit
+      - name: gitea storage audit as root (read-only)
         run: |
           set +e
-          echo "== whoami"; id
-          echo "== /mnt/appdata"; ls -la /mnt/appdata 2>&1 | head -60
-          echo "== stat gitea"; stat -c '%A %U:%G %n' /mnt/appdata/gitea 2>&1
-          echo "== du appdata top-level"; du -xsh /mnt/appdata/* 2>/dev/null | sort -h
-          echo "== du gitea top-level"; du -xsh /mnt/appdata/gitea/* 2>&1 | sort -h
-          echo "== du gitea/data"; du -xsh /mnt/appdata/gitea/data/* 2>&1 | sort -h
-          echo "== sudo check"; sudo -n true 2>&1; echo "sudo rc=$?"
+          IMG=alpine:3.20
+          docker image inspect "$IMG" >/dev/null 2>&1 || docker pull -q "$IMG" || true
+          docker run --rm -v /mnt/appdata:/a:ro "$IMG" sh -c '
+            echo "== gitea top-level"; du -xsh /a/gitea/* 2>&1 | sort -h
+            echo "== gitea/data";     du -xsh /a/gitea/data/* 2>&1 | sort -h
+            echo "== dumps count"; ls -1 /a/gitea/dumps 2>/dev/null | wc -l
+            echo "== repos: owner/repo (top 40 by size)"
+            du -xsh /a/gitea/data/gitea-repositories/*/* 2>/dev/null | sort -h | tail -40
+            echo "== lfs"; du -xsh /a/gitea/data/lfs 2>/dev/null
+            echo "== packages"; du -xsh /a/gitea/data/packages 2>/dev/null
+            echo "== biggest files >100M"
+            find /a/gitea -xdev -type f -size +100M -printf "%s %p\n" 2>/dev/null | sort -n | tail -25
+          '