diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index 83cc171..a8c19bb 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -28,10 +28,16 @@ jobs:
     runs-on: ubuntu-latest
     # Flakes for every `nix` invocation in the job (the bare `nix flake
     # check` below relies on this; the scripts pass the flag themselves).
-    # NIX_SSL_CERT_FILE because we add nix to PATH without sourcing the
-    # installer's profile (which is what normally exports it).
+    # sandbox=false because Stylix/base16.nix do import-from-derivation —
+    # eval realizes fetched `-source` paths mid-check, and the single-user
+    # Nix in this container can't set up the build sandbox (no user
+    # namespaces), which otherwise surfaces as "path '…-source' is not
+    # valid". NIX_SSL_CERT_FILE because we add nix to PATH without sourcing
+    # the installer's profile (which is what normally exports it).
     env:
-      NIX_CONFIG: "experimental-features = nix-command flakes"
+      NIX_CONFIG: |
+        experimental-features = nix-command flakes
+        sandbox = false
       NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
     steps:
       - name: Checkout