diff --git a/.github/docker/Dockerfile.ci b/.github/docker/Dockerfile.ci
index 0149cf8e..7da412f1 100644
--- a/.github/docker/Dockerfile.ci
+++ b/.github/docker/Dockerfile.ci
@@ -58,4 +58,4 @@ RUN mv /workspace/node_modules /opt/node_modules_cache \
 RUN useradd -m -s /bin/bash runner \
     && chmod -R a+rX /opt/node_modules_cache \
     && mkdir -p /home/runner/.gstack && chown -R runner:runner /home/runner/.gstack \
-    && mkdir -p /tmp/bun-cache && chmod 1777 /tmp/bun-cache
+    && chmod 1777 /tmp
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index 7487682b..f073ba03 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -98,10 +98,12 @@ jobs:
         with:
           fetch-depth: 0
 
-      # Bun needs a writable tmpdir — GH Actions container user may not own the default
+      # Bun needs a writable tmpdir — GH Actions container user may not own the default.
+      # Force /tmp writable for all users (container default may be root-only).
       - name: Fix temp dirs
         run: |
-          mkdir -p "$HOME/tmp"
+          chmod 1777 /tmp 2>/dev/null || sudo chmod 1777 /tmp 2>/dev/null || true
+          mkdir -p "$HOME/tmp" && chmod 1777 "$HOME/tmp"
           echo "TMPDIR=$HOME/tmp" >> "$GITHUB_ENV"
           echo "BUN_TMPDIR=$HOME/tmp" >> "$GITHUB_ENV"