diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 938696e..c7ed6cc 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -338,11 +338,20 @@ jobs:
       - name: Detect changed docker-built services
         id: services
         shell: bash
+        env:
+          PUSH_BEFORE: ${{ github.event.before }}
         run: |
           set -euo pipefail
-          base="${{ github.event.before }}"
-          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
-            base="$(git rev-list --max-parents=0 HEAD)"
+          base="${PUSH_BEFORE:-}"
+          empty_tree="$(git hash-object -t tree /dev/null)"
+          if [[ "$base" =~ ^0{40}$ ]]; then
+            base="$empty_tree"
+          elif [[ ! "$base" =~ ^[0-9a-fA-F]{40}$ ]] || ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            # Some Gitea push payloads expose `before` as multiple root commits
+            # joined by newlines. It is not a usable diff base; use this push's
+            # first parent so image changes in the current commit are still built.
+            base="$(git rev-parse "${GITHUB_SHA}^" 2>/dev/null || printf '%s' "$empty_tree")"
+            echo "::warning::invalid push-before value; comparing against ${base}"
           fi
 
           # A failed diff used to leave changed_files empty, which reads exactly