diff --git a/containers/server-n0/git.nix b/containers/server-n0/git.nix
index d403b67..1e68282 100644
--- a/containers/server-n0/git.nix
+++ b/containers/server-n0/git.nix
@@ -104,17 +104,19 @@ in
       let
         runnerInstanceName = "ci-runner";
 
+        ciJobContents = with pkgs; [
+          bashInteractive
+          coreutils
+          gitMinimal
+          nixVersions.latest
+          nodejs
+          cacert
+        ];
+
         ciJobImage = pkgs.dockerTools.buildLayeredImage {
           name = "ci-job-image";
           tag = "latest";
-          contents = with pkgs; [
-            bashInteractive
-            coreutils
-            gitMinimal
-            nixVersions.latest
-            nodejs
-            cacert
-          ];
+          contents = ciJobContents;
           config = {
             Cmd = [ "/bin/sh" ];
             Env = [
@@ -130,6 +132,10 @@ in
         boot.kernelModules = [ "kvm-intel" ];
         boot.extraModprobeConfig = "options kvm_intel nested=1";
 
+        # volume-mounted into CI containers; must be in VM's store so
+        # image symlinks (/bin/node etc.) resolve through the mount
+        system.extraDependencies = ciJobContents;
+
         microvm.writableStoreOverlay = "/nix/.rw-store";
 
         nix.settings = {