diff --git a/.github/docker/Dockerfile.ci b/.github/docker/Dockerfile.ci
index 6fbfefb0..1bb0ffbd 100644
--- a/.github/docker/Dockerfile.ci
+++ b/.github/docker/Dockerfile.ci
@@ -59,8 +59,5 @@ RUN useradd -m -s /bin/bash runner \
     && chmod -R a+rX /opt/node_modules_cache \
     && mkdir -p /home/runner/.gstack && chown -R runner:runner /home/runner/.gstack \
     && chmod 1777 /tmp \
-    && mkdir -p /home/runner/.bun && chown -R runner:runner /home/runner/.bun
-
-# NOTE: Do NOT use USER runner here — GH Actions overrides USER and HOME
-# anyway, creating permission conflicts. Instead, we run as root (GH default)
-# and use gosu/su-exec for claude commands that refuse root.
+    && mkdir -p /home/runner/.bun && chown -R runner:runner /home/runner/.bun \
+    && chmod -R 1777 /tmp
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index 4a26716a..05c67370 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -62,6 +62,7 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
+      options: --user runner
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -97,9 +98,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      # Bun creates root-owned temp dirs during Docker build. GH Actions runs as
+      # runner user with HOME=/github/home. Redirect bun's cache to a writable dir.
+      - name: Fix bun temp
+        run: |
+          mkdir -p /home/runner/.cache/bun
+          echo "BUN_INSTALL_CACHE_DIR=/home/runner/.cache/bun" >> "$GITHUB_ENV"
+          echo "BUN_TMPDIR=/home/runner/.cache/bun" >> "$GITHUB_ENV"
+          echo "TMPDIR=/home/runner/.cache" >> "$GITHUB_ENV"
+
       # Restore pre-installed node_modules from Docker image via symlink (~0s vs ~15s install)
-      # If package.json changed since image was built, fall back to fresh install
-      # Note: GITHUB_ENV vars from previous step are now active
       - name: Restore deps
         run: |
           if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.package.json package.json >/dev/null 2>&1; then