diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml
index 6baa6b4..c2f972d 100644
--- a/.gitea/workflows/gitea-main-ci.yaml
+++ b/.gitea/workflows/gitea-main-ci.yaml
@@ -118,8 +118,11 @@ jobs:
         name: Install build-host tooling
         # Tools the shell-local post-processors run on the RUNNER (not the VM):
         # libguestfs (virt-*), erofs-utils (mkfs.erofs), cryptsetup
-        # (veritysetup), jq, systemd-ukify (ukify), buildah (OCI), plus qemu +
-        # shellcheck for the lint gate.
+        # (veritysetup), jq, systemd-ukify (ukify), sbsigntool (sbsign — used by
+        # ukify to sign the UKI when SB_KEY/SB_CERT are set), buildah (OCI), plus
+        # qemu + shellcheck for the lint gate.
+        # NB: the Debian/Ubuntu package is sbsigntool (singular); on Fedora/RHEL
+        # it's sbsigntools (plural).
         #
         # libguestfs builds a supermin appliance on first use, which needs a
         # kernel + modules present on the runner (incl. xfs, to read the build
@@ -134,7 +137,7 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             qemu-system-x86 qemu-utils libguestfs-tools linux-image-generic \
             erofs-utils cryptsetup-bin jq systemd-ukify systemd-boot-efi \
-            buildah shellcheck attr
+            sbsigntool buildah shellcheck attr
           sudo chmod 0644 /boot/vmlinuz-* 2>/dev/null || true
 
       -