diff --git a/scripts/admit b/scripts/admit
index d06c0b7..cb0a5b0 100755
--- a/scripts/admit
+++ b/scripts/admit
@@ -23,6 +23,7 @@ set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")/.."
 ROOT="$PWD"
+
 RECEIPTS="${STREAM_RECEIPTS_DIR:-$ROOT/receipts}"
 IMAGE_REPO="${STREAM_IMAGE_REPO:-atcr.io/zat.dev/stream}"
 # Registry auth is the caller's problem: `publish` needs a docker login for
@@ -36,6 +37,25 @@ note() { printf '\033[1m==> %s\033[0m\n' "$*" >&2; }
 
 # Receipts are outputs, not source. A run writes its own receipt into the repo,
 # so counting it as drift would make every completed run look dirty.
+# The gate host's default zig also serves projects on other compiler versions,
+# so a run picks the compiler this tree declares instead of whatever `zig`
+# resolves to: STREAM_ZIG_DIR, else the conventional per-version install.
+# A mismatch stops here rather than failing somewhere inside the first suite.
+# Only `run` compiles on the host; `verify` runs where no compiler exists.
+select_zig() {
+  local want have zig_dir
+  want=$(sed -n 's/.*\.minimum_zig_version = "\([^"]*\)".*/\1/p' build.zig.zon)
+  for zig_dir in "${STREAM_ZIG_DIR:-}" "$HOME/.local/opt/zig-$(uname -m)-linux-$want"; do
+    if [[ -n "$zig_dir" && -x "$zig_dir/zig" ]]; then
+      export PATH="$zig_dir:$PATH"
+      break
+    fi
+  done
+  have=$(zig version 2>/dev/null || echo none)
+  [[ "$have" == "$want" ]] || die "build.zig.zon requires zig $want but \`zig\` is $have;" \
+    "install it under ~/.local/opt/zig-$(uname -m)-linux-$want or set STREAM_ZIG_DIR"
+}
+
 tree_drift() { git status --porcelain -- ':!receipts'; }
 
 require_clean_tree() {
@@ -231,6 +251,7 @@ cmd_build() {
 }
 
 cmd_run() {
+  select_zig
   require_clean_tree
   local sha sha_full stamp receipt log_dir suites_json revisions image_id tag
   sha=$(git rev-parse --short HEAD)