diff --git a/.gitea/workflows/hub-check.yml b/.gitea/workflows/hub-check.yml
index a5a6eb6..161dfa3 100644
--- a/.gitea/workflows/hub-check.yml
+++ b/.gitea/workflows/hub-check.yml
@@ -117,8 +117,8 @@ jobs:
       - name: Prove real Claude SDK Bash sandbox boundary
         run: |
           set -euo pipefail
-          # The proof requires uid>0, CapEff=0, and NoNewPrivs=1. Gitea act often
-          # runs as root; switch to cphci then clear caps under no_new_privs.
+          # The proof requires uid>0, CapEff=0, and NoNewPrivs=1. Switch uid and
+          # clear capability sets in one setpriv call (as root).
           if ! id cphci >/dev/null 2>&1; then
             useradd --create-home --shell /bin/bash cphci
           fi
@@ -126,14 +126,13 @@ jobs:
           REPO_ROOT="$(cd .. && pwd)"
           NODE_BIN_DIR="$(dirname "$(command -v node)")"
           NPX_BIN="$(command -v npx)"
-          chown -R cphci:cphci "$REPO_ROOT/hub"
-          runuser -u cphci -- env \
-            HOME="/home/cphci" \
-            PATH="$NODE_BIN_DIR:/usr/local/bin:/usr/bin:/bin" \
-            CPH_SANDBOX_TEST_ROOT=/w/t \
-            /usr/bin/setpriv \
-              --inh-caps=-all --bounding-set=-all --no-new-privs \
-              bash -lc "cd '$REPO_ROOT/hub' && '$NPX_BIN' vitest run test/integration/agent-sandbox-linux.test.ts"
+          chown -R cphci:cphci "$REPO_ROOT/hub" /home/cphci
+          /usr/bin/setpriv \
+            --reuid=cphci --regid=cphci --init-groups \
+            --inh-caps=-all --bounding-set=-all --ambient-caps=-all \
+            --no-new-privs \
+            env HOME=/home/cphci PATH="$NODE_BIN_DIR:/usr/local/bin:/usr/bin:/bin" CPH_SANDBOX_TEST_ROOT=/w/t \
+            bash -lc "cd '$REPO_ROOT/hub' && '$NPX_BIN' vitest run test/integration/agent-sandbox-linux.test.ts"
 
       - name: Run unit tests
         run: npx vitest run test/unit