diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6dbb20f..d52cd46 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -23,6 +23,14 @@ jobs:
           java-version: '25'
           cache: maven
 
+      # setup-java provisions the JDK only — it does NOT install Maven, and the runner image has
+      # no mvn on PATH (a bare `mvn` exits 127). Install it separately. apt pulls a default JRE as
+      # a dependency; JAVA_HOME from setup-java still wins, which the version check below proves.
+      - name: Install Maven
+        run: |
+          apt-get update && apt-get install -y --no-install-recommends maven
+          mvn -version
+
       - name: Build and test
         working-directory: bridged
         # This IS the mock-socket surface CB-503 asks for: the pom's `default-excludes` profile