diff --git a/.forgejo/workflows/dev.yaml b/.forgejo/workflows/dev.yaml
index e6f9b21..7da4b2c 100644
--- a/.forgejo/workflows/dev.yaml
+++ b/.forgejo/workflows/dev.yaml
@@ -21,9 +21,11 @@ jobs:
 
       - name: Dependencies en securitytests
         run: |
-          npm ci
-          npm test
-          npm audit --omit=dev --audit-level=moderate
+          docker run --rm \
+            -v "$PWD:/app" \
+            -v /app/node_modules \
+            -w /app node:22-alpine \
+            sh -lc 'npm ci && npm test && npm audit --omit=dev --audit-level=moderate'
 
       - name: Image-tags bepalen
         id: meta
diff --git a/.forgejo/workflows/release.yaml b/.forgejo/workflows/release.yaml
index 9e1c8e6..2941afe 100644
--- a/.forgejo/workflows/release.yaml
+++ b/.forgejo/workflows/release.yaml
@@ -21,9 +21,11 @@ jobs:
 
       - name: Dependencies en securitytests
         run: |
-          npm ci
-          npm test
-          npm audit --omit=dev --audit-level=moderate
+          docker run --rm \
+            -v "$PWD:/app" \
+            -v /app/node_modules \
+            -w /app node:22-alpine \
+            sh -lc 'npm ci && npm test && npm audit --omit=dev --audit-level=moderate'
 
       - name: Image-tags bepalen
         id: meta
diff --git a/VERSION b/VERSION
index 384ed36..15700f5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.3.03-beta
+0.3.04-beta
diff --git a/public/js/core.js b/public/js/core.js
index 569ec33..12ebf4f 100644
--- a/public/js/core.js
+++ b/public/js/core.js
@@ -2,7 +2,7 @@
 "use strict";
 /* version — shown until /api/version resolves (or if the fetch fails, e.g. offline).
    Kept in sync by hand with the VERSION file at the repo root on every release. */
-const VERSION = "0.3.03-beta";
+const VERSION = "0.3.04-beta";
 (function(){
   const tag = document.getElementById("verTag");
   tag.textContent = "v"+VERSION;