diff --git a/.tangled/workflows/admission.yml b/.tangled/workflows/admission.yml
index 3f10ac1..c762cfc 100644
--- a/.tangled/workflows/admission.yml
+++ b/.tangled/workflows/admission.yml
@@ -37,8 +37,14 @@ steps:
   - name: toolchain
     command: |
       set -euo pipefail
-      curl -fSL https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz | tar xJ -C /opt
-      echo 'export PATH=/opt/zig-x86_64-linux-0.16.0:$PATH' > /tmp/env.sh
+      # Extract into the workspace, which exists and persists across steps.
+      # NixOS has no /opt, and tar's "cannot open" is a FATAL exit 2 — the
+      # entire reason every run since 2026-08-07 died in ~20s (ci.yml has
+      # always done it this way).
+      curl -fSL https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz |
+        tar xJ -C /tangled/workspace
+      mv /tangled/workspace/zig-x86_64-linux-0.16.0 /tangled/workspace/.zig
+      /tangled/workspace/.zig/zig version
       modprobe nbd || true   # powerloss oracle's containerized NBD device
 
   - name: upstream clone at pin
@@ -55,10 +61,18 @@ steps:
       nohup go run ./cmd/simulator serve --reset --accounts=100 --commits-per-sec=20 >/tmp/sim.log 2>&1 &
       until curl -s http://127.0.0.1:7777/ >/dev/null 2>&1; do sleep 2; done
 
+  - name: strict power-loss image
+    command: |
+      set -euo pipefail
+      # One-time networked bootstrap the powerloss suite requires; the run
+      # itself is offline. Cheap here, and its absence fails admit run.
+      export PATH=/tangled/workspace/.zig:$PATH
+      just powerloss-image
+
   - name: admission (suites + local native image + receipt)
     command: |
       set -euo pipefail
-      source /tmp/env.sh
+      export PATH=/tangled/workspace/.zig:$PATH
       printf '%s' "$ATCR_APP_PASSWORD" | docker login atcr.io -u zat.dev --password-stdin || true
       ./scripts/admit run
 
@@ -69,7 +83,7 @@ steps:
       # (an over-quota account denies every write scope). That must not
       # discard a passing gate: the receipt already binds the local image id,
       # and `admit publish` can pin the registry digest later.
-      source /tmp/env.sh
+      export PATH=/tangled/workspace/.zig:$PATH
       ./scripts/admit publish || echo "WARN: publish failed; receipt keeps its local image id"
 
   - name: emit receipt