diff --git a/.gitea/actions/local-ci-build/action.yml b/.gitea/actions/local-ci-build/action.yml
index 19d3b59..c265624 100644
--- a/.gitea/actions/local-ci-build/action.yml
+++ b/.gitea/actions/local-ci-build/action.yml
@@ -128,6 +128,24 @@ inputs:
     required: false
     default: ''
 
+  repo-branch:
+    description: >
+      Branch to clone in the target repo. Leave empty (default) to use
+      the workflow's own ref (github.ref_name) — correct only when
+      repo-url is the same repo as the workflow. Set explicitly (e.g.
+      "main") for cross-repo builds where repo-url points elsewhere.
+    required: false
+    default: ''
+
+  repo-commit:
+    description: >
+      Commit SHA to check out in the target repo. Leave empty (default)
+      to use github.sha only when repo-url is NOT overridden; for a
+      cross-repo build (repo-url set) an empty value means "branch tip,
+      no pin". Set explicitly to pin a specific commit of the target.
+    required: false
+    default: ''
+
   extra-guest-env-json:
     description: >
       JSON object of extra environment variables to inject into the build VM
@@ -189,6 +207,8 @@ runs:
         INPUT_ARTIFACT_NAME:         ${{ inputs.artifact-name }}
         INPUT_JOB_ID_SUFFIX:         ${{ inputs.job-id-suffix }}
         INPUT_REPO_URL:              ${{ inputs.repo-url }}
+        INPUT_REPO_BRANCH:           ${{ inputs.repo-branch }}
+        INPUT_REPO_COMMIT:           ${{ inputs.repo-commit }}
         INPUT_EXTRA_GUEST_ENV_JSON:  ${{ inputs.extra-guest-env-json }}
         INPUT_USE_SHARED_CACHE:      ${{ inputs.use-shared-cache }}
         INPUT_SKIP_ARTIFACT:         ${{ inputs.skip-artifact }}
@@ -226,6 +246,27 @@ runs:
             $repoUrl = '${{ github.server_url }}/${{ github.repository }}.git'
         }
 
+        # Resolve target branch/commit. github.ref_name/github.sha refer
+        # to the workflow's own repo — only valid when repo-url is NOT
+        # overridden. For a cross-repo build the caller must give
+        # repo-branch (and optionally repo-commit); an unset commit means
+        # "branch tip, no pin".
+        if ($env:INPUT_REPO_BRANCH) {
+            $repoBranch = $env:INPUT_REPO_BRANCH
+        }
+        else {
+            $repoBranch = '${{ github.ref_name }}'
+        }
+        if ($env:INPUT_REPO_COMMIT) {
+            $repoCommit = $env:INPUT_REPO_COMMIT
+        }
+        elseif ($env:INPUT_REPO_URL) {
+            $repoCommit = ''   # cross-repo: don't pin the workflow's sha
+        }
+        else {
+            $repoCommit = '${{ github.sha }}'
+        }
+
         # Resolve guest OS: honor explicit input; for Auto, infer from RUNNER_LABELS
         $resolvedGuestOS = $env:INPUT_GUEST_OS
         if ($resolvedGuestOS -eq 'Auto') {
@@ -262,8 +303,8 @@ runs:
             '-m', 'ci_orchestrator', 'job',
             '--job-id',                $jobId,
             '--repo-url',              $repoUrl,
-            '--branch',                '${{ github.ref_name }}',
-            '--commit',                '${{ github.sha }}',
+            '--branch',                $repoBranch,
+            '--commit',                $repoCommit,
             '--build-command',         $env:INPUT_BUILD_COMMAND,
             '--guest-artifact-source', $env:INPUT_ARTIFACT_SOURCE,
             '--guest-os',              $resolvedGuestOS,