diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6922d7d..053d5b3 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -70,9 +70,17 @@ jobs:
           docker rm "$cid" >/dev/null
           exit "$status"
       - run: go vet ./...
-      - run: go test ./... -v
+      # The end-to-end suites start an embedded Postgres, and initdb refuses to
+      # run as root, which is what a job container is. Run the tests as a
+      # throwaway unprivileged user (GitHub's hosted runners already are one).
+      - name: Testes
         env:
           TEST_DATABASE_URL: postgres://lambdamail_test:lambdamail_test@localhost:5432/lambdamail_test?sslmode=disable
+        run: |
+          id tester >/dev/null 2>&1 || useradd -m -u 1001 tester
+          chown -R tester:tester "$GITHUB_WORKSPACE"
+          runuser -u tester -- env "HOME=/home/tester" "PATH=$PATH" \
+            "TEST_DATABASE_URL=$TEST_DATABASE_URL" go test ./... -v
 
   ts-auth:
     name: TypeScript (auth)