diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7418145d..2cc1deae 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -59,11 +59,14 @@ jobs:
       - name: Assert no (upload|download)-artifact past v3
         shell: bash
         run: |
-          # Self-test: verify the regex catches v4+ (anchored to YAML `uses:` lines).
+          # Self-test: verify the regex catches v4+ and does not catch v3.
           tmp=$(mktemp)
           printf '        uses: actions/upload-artifact@v5\n' > "$tmp"
           grep -qP '^\s+uses:\s+actions/(upload|download)-artifact@v[4-9]' "$tmp" \
             || { echo "FAIL: guard self-test — regex missed upload-artifact@v5"; rm "$tmp"; exit 1; }
+          printf '        uses: actions/upload-artifact@v3\n' > "$tmp"
+          grep -qvP '^\s+uses:\s+actions/(upload|download)-artifact@v[4-9]' "$tmp" \
+            || { echo "FAIL: guard self-test — regex incorrectly flagged upload-artifact@v3"; rm "$tmp"; exit 1; }
           rm "$tmp"
           # Guard: Gitea Actions (act_runner) does not implement the v4 artifact protocol.
           # Both upload-artifact and download-artifact share the same incompatibility.