diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index bf4b933..83cc171 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -44,12 +44,16 @@ jobs:
         # node-runtime coupling. Single-user (--no-daemon) needs no systemd,
         # which the catthehacker container doesn't run as PID 1.
         #
-        # The installer runs as root here and validates build-users-group=
-        # nixbld from its bundled nix.conf even in single-user mode, aborting
-        # if the group is missing. Pre-create an empty nixbld group so that
-        # check passes — single-user builds run as root and never use it.
+        # The installer runs as root here and honours build-users-group=
+        # nixbld from its bundled nix.conf, aborting unless that group exists
+        # AND has members. Create the nixbld group + build users (what a
+        # multi-user install does) before running it.
         run: |
-          groupadd -r nixbld || true
+          groupadd -r nixbld 2>/dev/null || true
+          for i in $(seq 1 10); do
+            useradd -r -g nixbld -G nixbld -d /var/empty \
+              -s /usr/sbin/nologin -c "Nix build user $i" "nixbld$i" 2>/dev/null || true
+          done
           curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
           echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"