diff --git a/.gitea/workflows/validate-pr.yml b/.gitea/workflows/validate-pr.yml
index 14f60ec..d9e8ce4 100644
--- a/.gitea/workflows/validate-pr.yml
+++ b/.gitea/workflows/validate-pr.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: self-hosted
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0           # need full history for `git diff base...HEAD`
 
       # 1. Identify which recipes the PR touches.
       - name: detect changed packages
@@ -17,6 +19,10 @@ jobs:
         run: |
           set -e
           base="${{ github.event.pull_request.base.sha }}"
+          # act's actions/checkout@v4 doesn't reliably pull the base SHA
+          # into the local history even with fetch-depth: 0. Fetch it
+          # explicitly so the three-dot diff resolves.
+          git fetch --depth=1 origin "$base" || git fetch --depth=1 origin
           changed=$(git diff --name-only "$base"...HEAD -- 'recipes/' \
             | awk -F/ '{print $2}' | sort -u)
           if [[ -z "$changed" ]]; then
diff --git a/runner/flake.nix b/runner/flake.nix
index af46c70..d76b95c 100644
--- a/runner/flake.nix
+++ b/runner/flake.nix
@@ -42,6 +42,7 @@
             curl
             jq
             tea
+            nodejs_20            # JS-based actions/checkout@v4 etc. need `node` on PATH
 
             cacert
             iana-etc
@@ -50,7 +51,7 @@
           # Skeleton filesystem layout: /tmp, /etc/passwd for nix,
           # writable nix store, cacert pointer.
           extraCommands = ''
-            mkdir -p tmp etc nix/var/{nix,log/nix} root
+            mkdir -p tmp etc/nix nix/var/{nix,log/nix} root
             chmod 1777 tmp
 
             cat > etc/passwd <<'EOF'