diff --git a/.tangled/workflows/admission.yml b/.tangled/workflows/admission.yml
index 1758bf3..3f10ac1 100644
--- a/.tangled/workflows/admission.yml
+++ b/.tangled/workflows/admission.yml
@@ -14,20 +14,18 @@ when:
 engine: microvm
 image: nixos
 
-# Keyed by registry, matching ci.yml/publish-image.yml. A bare list here is a
-# schema error that fails the run in ~15s before any step executes — which is
-# why this workflow never once ran (2026-08-07..09).
+# microVM takes a FLAT list (the registry-keyed map is nixery-only) — see
+# docs.tangled.org/spindles.
 dependencies:
-  nixpkgs:
-    - just
-    - python3
-    - uv
-    - go
-    - git
-    - jq
-    - curl
-    - xz
-    - e2fsprogs
+  - just
+  - python3
+  - uv
+  - go
+  - git
+  - jq
+  - curl
+  - xz
+  - e2fsprogs
 
 virtualisation:
   docker: true
diff --git a/.tangled/workflows/probe-microvm.yml b/.tangled/workflows/probe-microvm.yml
new file mode 100644
index 0000000..a01da82
--- /dev/null
+++ b/.tangled/workflows/probe-microvm.yml
@@ -0,0 +1,28 @@
+# Throwaway probe: does this spindle run the microvm engine at all?
+# admission.yml has failed in ~15s on every push since 2026-08-07 with no
+# step logs, which is consistent with the run dying before any step. This
+# isolates the engine from everything admission.yml also asks for (docker,
+# nbd, a zig toolchain, a cloned upstream). Delete once the answer is known.
+
+when:
+  - event: ["push"]
+    branch: ["main"]
+  - event: ["manual"]
+
+engine: microvm
+image: nixos
+
+dependencies:
+  - jq
+
+steps:
+  - name: hello
+    command: |
+      set -euo pipefail
+      echo "microvm engine works"
+      uname -a
+      jq --version
+
+  - name: docker available?
+    command: |
+      command -v docker && docker info >/dev/null 2>&1 && echo "docker: yes" || echo "docker: no"