diff --git a/.tangled/workflows/admission.yml b/.tangled/workflows/admission.yml
index 37c6ce2..1758bf3 100644
--- a/.tangled/workflows/admission.yml
+++ b/.tangled/workflows/admission.yml
@@ -14,16 +14,20 @@ when:
 engine: microvm
 image: nixos
 
+# Keyed by registry, matching ci.yml/publish-image.yml. A bare list here is a
+# schema error that fails the run in ~15s before any step executes — which is
+# why this workflow never once ran (2026-08-07..09).
 dependencies:
-  - just
-  - python3
-  - uv
-  - go
-  - git
-  - jq
-  - curl
-  - xz
-  - e2fsprogs
+  nixpkgs:
+    - just
+    - python3
+    - uv
+    - go
+    - git
+    - jq
+    - curl
+    - xz
+    - e2fsprogs
 
 virtualisation:
   docker: true