diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index e5e6a93..d1543da 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -14,7 +14,7 @@ jobs:
       # Daemonless image builder: kaniko :debug plus the /bin/sleep symlink
       # act needs for job-container PID 1 (see ci/Dockerfile.kaniko-act).
       # No docker socket, no privileges.
-      image: pi5-16.local:3005/mikkeli/kaniko-act:v1.23.2
+      image: pi5-16.local:3005/mikkeli/kaniko-act:v1.23.2-r2
 
     steps:
       - name: Fetch source, build, push
diff --git a/ci/Dockerfile.kaniko-act b/ci/Dockerfile.kaniko-act
index 3cb63b7..096d33d 100644
--- a/ci/Dockerfile.kaniko-act
+++ b/ci/Dockerfile.kaniko-act
@@ -1,8 +1,9 @@
 # Kaniko executor adapted for Gitea act_runner job containers.
 #
-# act starts job containers with entrypoint /bin/sleep; kaniko's image
-# already symlinks /bin/sh -> /busybox/sh but ships no /bin/sleep.
-# This wrapper adds that one symlink. Nothing else changes.
+# act starts job containers with entrypoint /bin/sleep and sets
+# RUNNER_TEMP=/tmp; kaniko's scratch-based image has neither /bin/sleep
+# (busybox lives under /busybox; /bin/sh is already symlinked) nor /tmp.
+# This wrapper adds exactly those two. Nothing else changes.
 #
 # Bootstrap: the first build of this image is done manually on the host
 # (docker build -f ci/Dockerfile.kaniko-act -t <registry>/mikkeli/kaniko-act:<ver> .)
@@ -10,4 +11,4 @@
 # the build-image workflow itself, using the previous kaniko-act.
 FROM gcr.io/kaniko-project/executor:v1.23.2-debug
 SHELL ["/busybox/sh", "-c"]
-RUN ln -sf /busybox/sleep /bin/sleep
+RUN ln -sf /busybox/sleep /bin/sleep && mkdir -p -m 1777 /tmp