diff --git a/.github/actions/register-gstack-skills/action.yml b/.github/actions/register-gstack-skills/action.yml
index 6782a11dd..62f534b4d 100644
--- a/.github/actions/register-gstack-skills/action.yml
+++ b/.github/actions/register-gstack-skills/action.yml
@@ -37,6 +37,13 @@ runs:
         # The gstack root stays a symlink — the preamble's runtime bash resolves
         # ~/.claude/skills/gstack/bin/* and ~/.claude/skills/gstack/<skill>/sections/*
         # through it, and bash follows cross-mount symlinks fine.
+        # `ln -snf` replaces a stale SYMLINK but hard-errors on a REAL
+        # directory under set -eu — clear a real-dir leftover first so the
+        # composite is rerun-safe (codex diff review). CI HOMEs are fresh;
+        # this only fires on a dirty rerun.
+        if [ -d "$SKILLS_DIR/gstack" ] && [ ! -L "$SKILLS_DIR/gstack" ]; then
+          rm -rf "${SKILLS_DIR:?}/gstack"
+        fi
         ln -snf "$REPO" "$SKILLS_DIR/gstack"
         for s in $SKILLS; do
           rm -rf "${SKILLS_DIR:?}/$s"
diff --git a/.github/actions/restore-deps/action.yml b/.github/actions/restore-deps/action.yml
index 187956a4e..ce81888ea 100644
--- a/.github/actions/restore-deps/action.yml
+++ b/.github/actions/restore-deps/action.yml
@@ -13,6 +13,11 @@ runs:
     - shell: bash
       run: |
         if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.bun.lock bun.lock >/dev/null 2>&1; then
+          # rm first: `cp -r SRC node_modules` with an existing node_modules
+          # NESTS the copy (node_modules/node_modules_cache) and leaves stale
+          # deps active. CI workspaces are fresh today, but a reusable
+          # composite must survive a rerun/dirty workspace (codex diff review).
+          rm -rf node_modules
           cp -r /opt/node_modules_cache node_modules
         else
           bun install