diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 20a0533..4437fea 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -177,7 +177,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-    uses: projectbluefin/actions/.github/workflows/server-installer-test.yml@6b4accef9cf5b79e68100d6c8d50b397640ba208 # v1
+    uses: projectbluefin/actions/.github/workflows/server-installer-test.yml@4d220f3f5448dd5f4a8f64a0ec1fad042b1dc85e # v1
     with:
       artifact-name: server-installer-test
 
diff --git a/Justfile b/Justfile
index 7e62d4d..932ebfc 100644
--- a/Justfile
+++ b/Justfile
@@ -342,8 +342,15 @@ test-installer-artifact:
       > "$REPART_DIR/30-var.conf"
 
     echo "==> Refreshing target /var partition using systemd-repart..."
-    # systemd-repart operates on the target image directly without loopback/sudo when passed as the target operand.
-    unshare -r systemd-repart \
+    REPART=(unshare -r systemd-repart)
+    if ! unshare -r true 2>/dev/null; then
+      if ! sudo -n true 2>/dev/null; then
+        echo "ERROR: systemd-repart needs unprivileged user namespaces or passwordless sudo" >&2
+        exit 1
+      fi
+      REPART=(sudo systemd-repart)
+    fi
+    "${REPART[@]}" \
       --factory-reset=yes \
       --dry-run=no \
       --definitions="$REPART_DIR" \
diff --git a/docs/skills/ddi-installer-build.md b/docs/skills/ddi-installer-build.md
index 0916d10..1b9dd14 100644
--- a/docs/skills/ddi-installer-build.md
+++ b/docs/skills/ddi-installer-build.md
@@ -34,6 +34,8 @@ just test-installer-artifact # test already-exported artifacts in QEMU without r
 just tags                  # show FSDK-derived version tags
 ```
 
+`test-installer-artifact` uses an unprivileged user namespace for host-side `systemd-repart` when available. GitHub-hosted runners disable that facility, so the recipe falls back to passwordless `sudo` for `systemd-repart` only; QEMU remains rootless.
+
 ## Mandatory build path: ghost cluster
 
 This project MUST always build on the ghost cluster using distributed BuildStream: