diff --git a/.gitea/workflows/dev.yml b/.gitea/workflows/dev.yml
index 69e3d1f..ea4c1a3 100644
--- a/.gitea/workflows/dev.yml
+++ b/.gitea/workflows/dev.yml
@@ -31,6 +31,17 @@ jobs:
           password: ${{ secrets.TOKEN }}
       - name: Init submodules (ensure up-to-date)
         run: |
+          echo "Sanitize submodule config"
+          ALLOWED_PATHS=$(git config -f .gitmodules --get-regexp '^submodule\..*\.path$' | awk '{print $3}' || true)
+          for NAME in $(git config --local --name-only --get-regexp '^submodule\..*\.path$' | sed 's/\.path$//' || true); do
+            P=$(git config --local --get "$NAME.path" || true)
+            if ! printf "%s\n" "$ALLOWED_PATHS" | grep -qx "$P"; then
+              echo "[ci] deinit orphan submodule: $P ($NAME)"
+              git submodule deinit -f -- "$P" || true
+              git config --local --remove-section "$NAME" || true
+              rm -rf ".git/modules/$P" || true
+            fi
+          done
           git submodule sync --recursive
           git submodule update --init --recursive
       - name: Build and push images