diff --git a/.envrc b/.envrc
index 42936b3..8b6df59 100644
--- a/.envrc
+++ b/.envrc
@@ -20,8 +20,9 @@ fi
 # Project environment variables
 export PROJECT_NAME="Haec"
 export RSR_TIER="infrastructure"
-# export DATABASE_URL="..."
-# export API_KEY="..."
+# Project secrets (DATABASE_URL, API_KEY, ...) belong in .env, which is
+# gitignored and sourced below. Do not add them here: .envrc is committed,
+# and assignment-shaped comments trip secret scanners.
 
 # Source .env if it exists (gitignored)
 dotenv_if_exists
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02a4a1f..1d2d5e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,6 +26,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # The pinned idris2-pack image ships no xz binary, so setup-zig's
+      # .tar.xz download fails with "tar (child): xz: Cannot exec".
+      - name: Install xz (needed to unpack the Zig tarball)
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v xz >/dev/null 2>&1; then
+            apt-get update -qq
+            apt-get install -y -qq --no-install-recommends xz-utils
+          fi
+          xz --version | head -1
+
       - name: Set up Zig
         uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
         with: