diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e970f50..8f67d98 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -337,6 +337,40 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # The daemon and the client are two different things to have, and this runner had only
+      # one of them. Testcontainers reaches Docker straight over /var/run/docker.sock from a
+      # .NET library, so every integration suite in the build job passed while `docker` was
+      # not a command here at all — which surfaced as exit 127 from the build step below,
+      # after the tags had been worked out and everything looked healthy.
+      #
+      # Only the CLI. The socket is already there and a daemon is already answering on it;
+      # installing an engine would start a second one beside the one being used.
+      - name: ensure the docker cli
+        run: |
+          set -eu
+          SUDO=""
+          [ "$(id -u)" -eq 0 ] || SUDO="sudo"
+
+          if command -v docker >/dev/null 2>&1; then
+            docker --version
+            exit 0
+          fi
+
+          echo "Installing the docker cli"
+          if command -v apk >/dev/null 2>&1; then
+            $SUDO apk add --no-cache docker-cli
+          elif command -v apt-get >/dev/null 2>&1; then
+            $SUDO apt-get update -qq
+            $SUDO apt-get install -y --no-install-recommends docker.io
+          elif command -v dnf >/dev/null 2>&1; then
+            $SUDO dnf install -y docker-cli
+          else
+            echo "No apt-get, apk or dnf here, so the docker client cannot be installed from" >&2
+            echo "inside the job. Add it to the runner's image." >&2
+            exit 1
+          fi
+          docker --version
+
       # No docker/* actions here, deliberately. The build is single-architecture, so it
       # needs the daemon this runner already has for the Testcontainers suites and nothing
       # else — no buildx plugin, no QEMU, and no third-party action whose SHA has to be