diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 534c173..86fd116 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -69,7 +69,20 @@ jobs:
           # cluster_name (the OpenSearch image maps dotted env keys to
           # settings).
           cluster.name: opt_ci_${{ github.run_id }}_${{ github.run_attempt }}
+        # `--workdir` is REQUIRED (measured 2026-08-31, PR #25 CI run 7745,
+        # job "integration"): this runner's act_runner (v0.6.1) merges the
+        # JOB's WorkingDir (`/workspace/sax3l/0pt`) into every SERVICE
+        # container's config, clobbering the image's own `WORKDIR
+        # /usr/share/opensearch`. OpenSearch's ENTRYPOINT is the
+        # WORKDIR-relative `./opensearch-docker-entrypoint.sh`, so with the
+        # wrong cwd the container failed with "exec:
+        # \"./opensearch-docker-entrypoint.sh\": stat ...: no such file or
+        # directory" before it ever bound a port. ClickHouse's entrypoint is
+        # an absolute path, so it was unaffected by the same defect — do not
+        # assume a green ClickHouse service means service-container options
+        # are fine in general.
         options: >-
+          --workdir /usr/share/opensearch
           --health-cmd "curl -fsS http://localhost:9200/_cluster/health || exit 1"
           --health-interval 10s
           --health-timeout 5s