diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index decade9..bf68d24 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -6,5 +6,10 @@ jobs:
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+              # The default clone is shallow and has no tags, so the
+              # version the build takes from `git describe` would be a
+              # bare commit; this fetches the whole history with its tags.
+              with:
+                  fetch-depth: 0
             - run: script/cibuild
             - run: script/docker-smoke
diff --git a/TODO.md b/TODO.md
index f725367..6a4e5d3 100644
--- a/TODO.md
+++ b/TODO.md
@@ -31,6 +31,10 @@ P2: security: per-IP rate limiting on the image routes
 
 # Completed Steps
 
+- 2026-10-04 the CI checkout fetches the tags (closes #208): the checkout step
+  in `.gitea/workflows/check.yml` sets `fetch-depth: 0`, as `REPO_POLICIES.md`
+  asks of a repo that takes its version from the tags, so a CI build of a tagged
+  commit stamps the tag from `git describe` instead of a bare commit.
 - 2026-10-04 `cmd/pixad/main.go` is one call into `internal/` (closes #206):
   what it did (the command line and its `--config` flag, setting
   `PIXA_CONFIG_PATH`, ignoring `SIGPIPE`, starting the fx app) is now `Run` in