diff --git a/TROUBLESHOOTING.md b/TROUBLESHOOTING.md
index 142983d..9db0c52 100644
--- a/TROUBLESHOOTING.md
+++ b/TROUBLESHOOTING.md
@@ -27,3 +27,9 @@ ipcs -m
 ipcrm -m 0
 ipcrm -m 1
 ```
+
+## shiro pulls GHC (Haskell) during system build
+
+`pkgs.writeShellApplication` runs shellcheck at build time as part of `nativeBuildInputs`. `shellcheck-*-bin` for `aarch64-darwin` is not in `cache.nixos.org`, so it builds from source — which pulls GHC (~2.5 GiB unpacked).
+
+**Fix in tree:** `darwin/shiro/services/gitea-runner.nix` uses `pkgs.writeShellScriptBin` instead and prepends `lib.makeBinPath` to `PATH` manually. `checkPhase = "true"` is not enough — shellcheck stays in `nativeBuildInputs` regardless.
diff --git a/darwin/shiro/services/gitea-runner.nix b/darwin/shiro/services/gitea-runner.nix
index 7e22f78..1317da3 100644
--- a/darwin/shiro/services/gitea-runner.nix
+++ b/darwin/shiro/services/gitea-runner.nix
@@ -43,43 +43,41 @@
     wget
   ];
 
-  runnerScript = pkgs.writeShellApplication {
-    name = "gitea-runner-${name}";
-    runtimeInputs = hostPackages ++ [pkgs.gitea-actions-runner];
-    text = ''
-      INSTANCE_DIR="${stateDir}"
-      mkdir -p "$INSTANCE_DIR"
-      cd "$INSTANCE_DIR"
+  runnerScript = pkgs.writeShellScriptBin "gitea-runner-${name}" ''
+    set -euo pipefail
+    export PATH=${lib.makeBinPath (hostPackages ++ [pkgs.gitea-actions-runner])}:$PATH
 
-      TOKEN_FILE="${config.sops.templates."GITEA_RUNNER_TOKEN.env".path}"
-      while [ ! -f "$TOKEN_FILE" ]; do
-        echo "Waiting for SOPS secrets..."
-        sleep 5
-      done
+    INSTANCE_DIR="${stateDir}"
+    mkdir -p "$INSTANCE_DIR"
+    cd "$INSTANCE_DIR"
 
-      # shellcheck disable=SC1090
-      source "$TOKEN_FILE"
+    TOKEN_FILE="${config.sops.templates."GITEA_RUNNER_TOKEN.env".path}"
+    while [ ! -f "$TOKEN_FILE" ]; do
+      echo "Waiting for SOPS secrets..."
+      sleep 5
+    done
 
-      LABELS_FILE="$INSTANCE_DIR/.labels"
-      LABELS_WANTED="${labelsSorted}"
-      LABELS_CURRENT="$(cat "$LABELS_FILE" 2>/dev/null || echo 0)"
+    source "$TOKEN_FILE"
 
-      if [ ! -e "$INSTANCE_DIR/.runner" ] || [ "$LABELS_WANTED" != "$LABELS_CURRENT" ]; then
-        rm -f "$INSTANCE_DIR/.runner"
+    LABELS_FILE="$INSTANCE_DIR/.labels"
+    LABELS_WANTED="${labelsSorted}"
+    LABELS_CURRENT="$(cat "$LABELS_FILE" 2>/dev/null || echo 0)"
 
-        act_runner register --no-interactive \
-          --instance ${lib.escapeShellArg url} \
-          --token "$TOKEN" \
-          --name ${lib.escapeShellArg name} \
-          --labels ${lib.escapeShellArg labelsStr} \
-          --config ${configFile}
+    if [ ! -e "$INSTANCE_DIR/.runner" ] || [ "$LABELS_WANTED" != "$LABELS_CURRENT" ]; then
+      rm -f "$INSTANCE_DIR/.runner"
 
-        echo "$LABELS_WANTED" > "$LABELS_FILE"
-      fi
+      act_runner register --no-interactive \
+        --instance ${lib.escapeShellArg url} \
+        --token "$TOKEN" \
+        --name ${lib.escapeShellArg name} \
+        --labels ${lib.escapeShellArg labelsStr} \
+        --config ${configFile}
 
-      exec act_runner daemon --config ${configFile}
-    '';
-  };
+      echo "$LABELS_WANTED" > "$LABELS_FILE"
+    fi
+
+    exec act_runner daemon --config ${configFile}
+  '';
 in {
   environment.etc."ssh/ssh_known_hosts".text = ''
     tako.darksailor.dev ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBt2bY4G9wfBf/6OsH+sLqA0GaQSTQUO2OCMhjQxwjJZ