diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index 3556efe..2e96965 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -18,4 +18,3 @@ jobs:
                   # All history and tags, so git describe finds the version tag.
                   fetch-depth: 0
             - run: script/cibuild
-            - run: script/docker-smoke
diff --git a/TODO.md b/TODO.md
index fb2cde2..e75260a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -30,6 +30,11 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-21 the Gitea workflow checks out the repo and runs `script/cibuild`,
+  nothing else (closes #203): its `script/docker-smoke` step is removed, as the
+  canonical `REPO_POLICIES.md` says, since `make check` covers what CI needs to
+  check. CI no longer starts the image and waits for its healthcheck.
+  `script/docker-smoke` and `make docker-smoke` stay, to run by hand.
 - 2026-10-20 a WebP, AVIF or JPEG XL encode at the limits takes at most about 34
   seconds (closes #272): with one libvips thread, 8192x8192 random pixels with
   an alpha channel took about 61 seconds to encode as WebP, 81 as JPEG XL and,
diff --git a/script/docker-smoke b/script/docker-smoke
index 05ed46a..3bd7862 100755
--- a/script/docker-smoke
+++ b/script/docker-smoke
@@ -1,8 +1,8 @@
 #!/bin/sh
 # script/docker-smoke: build the Docker image, start it, and wait up to
-# 30 seconds for its HEALTHCHECK to report healthy. Needs a Docker
-# daemon, so it is not part of script/check; the Gitea workflow runs it
-# after script/cibuild.
+# 30 seconds for its HEALTHCHECK to report healthy. It is not part of
+# script/check, which never starts the image, and the Gitea workflow
+# does not run it. Run it by hand.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"