diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 297c85f..978d2b2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -106,11 +106,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Single-user install: the runner is a container with no systemd, and
-      # the --daemon installer refuses without it.
+      # The runner container is root with no `nixbld` group, but the installer
+      # writes `build-users-group = nixbld` anyway and then fails on it, so the
+      # config goes in first. Flakes are off by default and `nix build .#…`
+      # needs them. Written again afterwards in case the installer replaced it.
       - name: Install nix
         run: |
+          mkdir -p /etc/nix
+          printf 'build-users-group =\nexperimental-features = nix-command flakes\n' > /etc/nix/nix.conf
           curl -fsSL https://nixos.org/nix/install | sh -s -- --no-daemon --yes
+          printf 'build-users-group =\nexperimental-features = nix-command flakes\n' > /etc/nix/nix.conf
           echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
 
       # The installer does not enable flakes, so `nix build .#…` needs the