diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
index 9f11ea6..ba6dfbf 100644
--- a/.github/workflows/build-iso.yml
+++ b/.github/workflows/build-iso.yml
@@ -100,6 +100,18 @@ jobs:
 
             cd /work
 
+            # Diagnostic: dump workspace state so a path/perm issue surfaces
+            # before commands silently no-op.
+            echo "=== /work diagnostic ==="
+            id
+            pwd
+            mountpoint /work || true
+            ls -la /work | head -20
+            ls -la /work/kickstart 2>&1 | head -10
+            touch /work/kickstart/.write-test && echo "[OK] /work/kickstart writable" || echo "[ERR] /work/kickstart NOT writable"
+            rm -f /work/kickstart/.write-test 2>/dev/null
+            echo "=== end diagnostic ==="
+
             # PATCH: livecd-creator bug — __get_efi_image_stanza writes
             # `root=live:LABEL=...` instead of `live:CDLABEL=...` for dracut.
             # Result: dracut hangs on parse-livenet looking for non-CD label.