diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index cff1d98..99c6664 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -125,21 +125,54 @@ jobs:
   secs4j-interop:
     runs-on: ubuntu-latest
     # secs4j-interop builds its own docker image (with JDK) and starts
-    # secs_server via docker compose; needs the docker socket.
+    # secs_server via docker compose; needs the docker socket, which
+    # is why this job runs on the bare runner rather than inside a
+    # `container:` like the other jobs.
+    #
+    # The bare runner image varies across deployments — catthehacker
+    # provides apt-get, but some gitea-act runners use a minimal node
+    # image with no package manager.  The bootstrap step detects what
+    # it has (apt-get / apk / nothing) and only installs missing
+    # pieces; node + git are usually already present so actions/checkout
+    # can run.
     steps:
-      - name: Bootstrap (node + git)
+      - name: Bootstrap (node + git + docker CLI if missing)
         run: |
-          export DEBIAN_FRONTEND=noninteractive
-          apt-get update
-          apt-get install -y --no-install-recommends \
-            git ca-certificates nodejs docker.io docker-compose-plugin
+          set -e
+          need_git=0; need_node=0; need_docker=0
+          command -v git    >/dev/null || need_git=1
+          command -v node   >/dev/null || need_node=1
+          command -v docker >/dev/null || need_docker=1
+          if [ "$need_git$need_node$need_docker" = "000" ]; then
+            echo "runner image already has git/node/docker — skipping install"
+            exit 0
+          fi
+          if command -v apt-get >/dev/null; then
+            export DEBIAN_FRONTEND=noninteractive
+            apt-get update
+            pkgs=""
+            [ "$need_git"    = "1" ] && pkgs="$pkgs git ca-certificates"
+            [ "$need_node"   = "1" ] && pkgs="$pkgs nodejs"
+            [ "$need_docker" = "1" ] && pkgs="$pkgs docker.io docker-compose-plugin"
+            apt-get install -y --no-install-recommends $pkgs
+          elif command -v apk >/dev/null; then
+            pkgs=""
+            [ "$need_git"    = "1" ] && pkgs="$pkgs git ca-certificates"
+            [ "$need_node"   = "1" ] && pkgs="$pkgs nodejs"
+            [ "$need_docker" = "1" ] && pkgs="$pkgs docker docker-cli-compose"
+            apk add --no-cache $pkgs
+          else
+            echo "no apt-get or apk — runner image has no package manager"
+            echo "need: git=$need_git node=$need_node docker=$need_docker"
+            exit 1
+          fi
 
       - uses: actions/checkout@v4
 
       # Cross-validate against secs4java8 (Apache 2.0, kenta-shimizu) —
-      # an independent SECS implementation in Java.  20 checks
-      # covering S1/S2/S3/S5/S14/S16 with full-body GEM 300 shapes
-      # that secsgem-py couldn't easily drive.
+      # an independent SECS implementation in Java.  55 checks
+      # covering S1/S2/S3/S5/S6/S7/S10/S14/S16 with full-body GEM 300
+      # shapes that secsgem-py couldn't easily drive.
       - name: secs4j cross-validation
         run: bash interop/secs4j_validate.sh