diff --git a/.gitea/workflows/windows-msix.yml b/.gitea/workflows/windows-msix.yml
index 99580565..ec9ce8cc 100644
--- a/.gitea/workflows/windows-msix.yml
+++ b/.gitea/workflows/windows-msix.yml
@@ -127,7 +127,10 @@ jobs:
       # hand-off shim. --no-default-features on ARM64 is a no-op for the shell.
       - name: Build (release)
         shell: pwsh
-        run: cargo build --release -p punktfunk-client-windows -p punktfunk-client-session ${{ matrix.session_flags }} --target ${{ matrix.target }}
+        # punktfunk-cli builds the `punktfunk.exe` the manifest aliases and pack-msix.ps1
+        # requires (bf981027 added the requirement without the build — same gap 90c84ef4
+        # closed for deb).
+        run: cargo build --release -p punktfunk-client-windows -p punktfunk-client-session -p punktfunk-cli ${{ matrix.session_flags }} --target ${{ matrix.target }}
 
       - name: Pack + sign MSIX
         shell: pwsh
diff --git a/ci/android-ci.Dockerfile b/ci/android-ci.Dockerfile
index 43f0ab13..9a417593 100644
--- a/ci/android-ci.Dockerfile
+++ b/ci/android-ci.Dockerfile
@@ -57,3 +57,11 @@ ARG SCCACHE_VERSION=0.10.0
 RUN curl -fsSL "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
     | tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache' \
     && sccache --version
+
+# actions/checkout (and every other JS action: cache, upload-artifact) execs `node` INSIDE
+# the job container — no node, no checkout (exit 127; same lesson flatpak.yml documents for
+# fedora:43). A separate trailing layer on purpose: appending here keeps the fat SDK/NDK
+# layers above cache-valid instead of invalidating the whole build.
+RUN apt-get update && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/* \
+    && node --version