diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9878d8b..cde47f5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, build-runner-fix]
 
 jobs:
   build-and-push:
diff --git a/.gitignore b/.gitignore
index 555444c..5858b13 100755
--- a/.gitignore
+++ b/.gitignore
@@ -468,3 +468,6 @@ lerna-debug.log*
 # Windows thumbnail cache
 Thumbs.db
 ehthumbs.db
+
+# Self-installed .NET SDK (scripts/ci/lib.sh ensure_dotnet, used when a CI runner lacks the SDK)
+/.dotnet/
diff --git a/scripts/ci/build.sh b/scripts/ci/build.sh
index 9faa9a3..5049c75 100755
--- a/scripts/ci/build.sh
+++ b/scripts/ci/build.sh
@@ -6,6 +6,8 @@ set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
 cd "$CI_ROOT"
 
+ensure_dotnet
+
 log "Restoring and publishing MicCheck.Api (Release)"
 dotnet publish src/api/MicCheck.Api/MicCheck.Api.csproj -c Release
 
diff --git a/scripts/ci/lib.sh b/scripts/ci/lib.sh
index 372a771..a121b4e 100755
--- a/scripts/ci/lib.sh
+++ b/scripts/ci/lib.sh
@@ -37,6 +37,23 @@ image_names() {
   ADMIN_IMAGE="$REGISTRY/$REGISTRY_OWNER/miccheck-admin"
 }
 
+# Installs .NET into $CI_ROOT/.dotnet via the vendored dotnet-install.sh if
+# `dotnet` isn't already on PATH, then prepends it to PATH for this process.
+# Keeps bare runners (no SDK preinstalled) working the same as a dev machine.
+ensure_dotnet() {
+  if command -v dotnet > /dev/null 2>&1; then
+    return 0
+  fi
+
+  local install_dir="$CI_ROOT/.dotnet"
+  if [[ ! -x "$install_dir/dotnet" ]]; then
+    log "dotnet not found on PATH; installing .NET SDK via dotnet-install.sh"
+    bash "$CI_ROOT/dotnet-install.sh" --channel LTS --install-dir "$install_dir"
+  fi
+  export PATH="$install_dir:$PATH"
+  export DOTNET_ROOT="$install_dir"
+}
+
 registry_login() {
   require_registry_vars
   [[ -n "$REGISTRY_USER" ]] || fail "REGISTRY_USER env var is required to push images"
diff --git a/scripts/ci/prepush.sh b/scripts/ci/prepush.sh
index b9ce38c..148d87b 100755
--- a/scripts/ci/prepush.sh
+++ b/scripts/ci/prepush.sh
@@ -5,6 +5,8 @@ set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
 cd "$CI_ROOT"
 
+ensure_dotnet
+
 log "Building full solution (Debug)"
 dotnet build MicCheck.slnx -c Debug
 
diff --git a/scripts/ci/test.sh b/scripts/ci/test.sh
index 5d7c5db..e8c6cf7 100755
--- a/scripts/ci/test.sh
+++ b/scripts/ci/test.sh
@@ -6,6 +6,8 @@ set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
 cd "$CI_ROOT"
 
+ensure_dotnet
+
 log "Running MicCheck.Api.Tests.Unit"
 dotnet test tests/api/MicCheck.Api.Tests.Unit/MicCheck.Api.Tests.Unit.csproj -c Release --logger trx