diff --git a/.gitea/workflows/gate.yml b/.gitea/workflows/gate.yml
index 7e0d617..74d7af6 100644
--- a/.gitea/workflows/gate.yml
+++ b/.gitea/workflows/gate.yml
@@ -130,6 +130,13 @@ jobs:
           REF: ${{ github.ref }}
         run: |
           set -euo pipefail
+          # act runs steps with umask 0000, so without this every checked-out directory is
+          # world-writable — and Ansible then IGNORES infra/ansible/ansible.cfg as a source
+          # ("Ansible is being run in a world writable directory"), which made the L0 check
+          # prod-baremetal-not-dev-surface fail on this PR's first CI run (run 500). The
+          # toolbox has Ansible, so that check now drives it for real. 0022 = what a
+          # workstation clone gets (reproduced locally: 0000 fails the check, 0022 passes).
+          umask 0022
           git config --global --add safe.directory "$PWD"
           git init -q .
           git remote add origin "${SERVER_URL}/${REPOSITORY}"
diff --git a/decisions/2026-11-08-gate-toolbox-container.md b/decisions/2026-11-08-gate-toolbox-container.md
index b6e0beb..a545e8a 100644
--- a/decisions/2026-11-08-gate-toolbox-container.md
+++ b/decisions/2026-11-08-gate-toolbox-container.md
@@ -24,6 +24,12 @@ is unchanged):
   every branch to `refs/remotes/origin/*`, tags, plus the event SHA; detached for a PR,
   `-B <branch>` for a push; asserts `HEAD == github.sha`. The job token goes to that one fetch via
   `GIT_CONFIG_*` env and is **not** persisted in `.git/config` (nothing later needs network git).
+  It sets **`umask 0022`** first: the PR's first CI run (run 500) failed L0
+  `prod-baremetal-not-dev-surface` because act runs steps with umask 0000, every checked-out
+  directory was world-writable, and Ansible (present in the toolbox, absent from the catthehacker
+  image) then ignored `infra/ansible/ansible.cfg`. Reproduced locally in the pinned image: clone
+  under umask 0000 → that check fails with the same message; under 0022 → `check OK`. Side
+  effect worth knowing: the Ansible-driven parts of that check now actually execute in CI.
 - **"Install pinned CI toolchain" step removed**, replaced by **"Toolchain is the one
   ci/versions.env pins"**: every `*_VERSION` in `ci/versions.env` must equal the image's
   `/etc/dev-toolchain-versions`, else `::error::DRIFT` and the job fails. Without this, dropping