diff --git a/.gitea/workflows/hub-check.yml b/.gitea/workflows/hub-check.yml
index 161dfa3..06eb918 100644
--- a/.gitea/workflows/hub-check.yml
+++ b/.gitea/workflows/hub-check.yml
@@ -123,6 +123,9 @@ jobs:
             useradd --create-home --shell /bin/bash cphci
           fi
           install -d -o cphci -g cphci -m 0700 /w/t
+          # bwrap needs unprivileged user namespaces once CapEff is emptied.
+          sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+          sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
           REPO_ROOT="$(cd .. && pwd)"
           NODE_BIN_DIR="$(dirname "$(command -v node)")"
           NPX_BIN="$(command -v npx)"