diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index 1ec63f2..9e526c4 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -26,17 +26,23 @@ on:
 jobs:
   eval-and-lint:
     runs-on: ubuntu-latest
+    # Flakes for every `nix` invocation in the job (the bare `nix flake
+    # check` below relies on this; the scripts pass the flag themselves).
+    env:
+      NIX_CONFIG: "experimental-features = nix-command flakes"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-        with:
-          # Match the runner's effective channel. Nomarchy itself tracks
-          # nixos-25.11 via flake.nix; the installer-action default is fine.
-          extra-conf: |
-            experimental-features = nix-command flakes
+        # Plain shell install rather than a JS action: act_runner's bundled
+        # `act` only supports up to node20, and nix-installer-action@main
+        # moved to node24 ("runs.using ... got node24"). A run step has no
+        # node-runtime coupling. Single-user (--no-daemon) needs no systemd,
+        # which the catthehacker container doesn't run as PID 1.
+        run: |
+          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+          echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
 
       - name: nix flake check --no-build
         run: nix flake check --no-build