diff --git a/.forgejo/workflows/stale-claims.yml b/.forgejo/workflows/stale-claims.yml
index 171c9ebe..98d9ae48 100644
--- a/.forgejo/workflows/stale-claims.yml
+++ b/.forgejo/workflows/stale-claims.yml
@@ -28,6 +28,18 @@ jobs:
       - name: Checkout repo
         uses: actions/checkout@v4
 
+      - name: Diagnostic — runner environment
+        run: |
+          echo "=== runner environment ==="
+          echo "shell: $SHELL"
+          echo "bash: $(bash --version | head -1)"
+          echo "python3: $(python3 --version 2>&1 || echo 'NOT INSTALLED')"
+          echo "curl: $(curl --version | head -1)"
+          echo "mktemp: $(mktemp --version | head -1 2>&1 || echo 'no --version')"
+          echo "pwd: $(pwd)"
+          echo "ls scripts/: $(ls scripts/ 2>&1)"
+          echo "script exists: $(test -f scripts/cleanup-stale-claims.sh && echo yes || echo no)"
+
       - name: Run cleanup script
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_BOT_QA_TOKEN }}
@@ -35,5 +47,14 @@ jobs:
           FORGEJO_REPO: lekss361/gendesign
           STALE_HOURS: 4
         run: |
+          echo "=== env check ==="
+          echo "FORGEJO_TOKEN length: ${#FORGEJO_TOKEN}"
+          echo "FORGEJO_URL: $FORGEJO_URL"
+          echo "FORGEJO_REPO: $FORGEJO_REPO"
+          echo "STALE_HOURS: $STALE_HOURS"
+          echo "=== check token works ==="
+          curl -sS -H "Authorization: token $FORGEJO_TOKEN" "$FORGEJO_URL/api/v1/user" | head -c 200
+          echo ""
+          echo "=== run script with -x trace ==="
           chmod +x scripts/cleanup-stale-claims.sh
-          ./scripts/cleanup-stale-claims.sh
+          bash -x scripts/cleanup-stale-claims.sh