diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index 9e526c4..bf4b933 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -28,8 +28,11 @@ jobs:
     runs-on: ubuntu-latest
     # Flakes for every `nix` invocation in the job (the bare `nix flake
     # check` below relies on this; the scripts pass the flag themselves).
+    # NIX_SSL_CERT_FILE because we add nix to PATH without sourcing the
+    # installer's profile (which is what normally exports it).
     env:
       NIX_CONFIG: "experimental-features = nix-command flakes"
+      NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -40,7 +43,13 @@ jobs:
         # moved to node24 ("runs.using ... got node24"). A run step has no
         # node-runtime coupling. Single-user (--no-daemon) needs no systemd,
         # which the catthehacker container doesn't run as PID 1.
+        #
+        # The installer runs as root here and validates build-users-group=
+        # nixbld from its bundled nix.conf even in single-user mode, aborting
+        # if the group is missing. Pre-create an empty nixbld group so that
+        # check passes — single-user builds run as root and never use it.
         run: |
+          groupadd -r nixbld || true
           curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
           echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"