diff --git a/.github/workflows/build-bluebuild.yml b/.github/workflows/build-bluebuild.yml
index a386a3b..2062d26 100644
--- a/.github/workflows/build-bluebuild.yml
+++ b/.github/workflows/build-bluebuild.yml
@@ -55,6 +55,15 @@ jobs:
         # Pinned to last v4 tag confirmed to ship on node20.
         uses: actions/checkout@v4.1.7
 
+      - name: Fix sudo perms (userns=host artefact)
+        run: |
+          # Daemon has userns-remap=default; the act job container is
+          # launched with --userns=host. The image was pulled under
+          # remap so /etc/sudo.conf + /etc/sudoers ship as uid 100000.
+          # sudo refuses to read either unless owned by uid 0. Restore.
+          chown -R 0:0 /etc/sudo.conf /etc/sudoers /etc/sudoers.d 2>/dev/null || true
+          ls -la /etc/sudo.conf /etc/sudoers 2>&1 | head -5
+
       - name: Install build tooling (Fedora)
         run: |
           set -euxo pipefail