diff --git a/nix/hosts/cc-ci/configuration.nix b/nix/hosts/cc-ci/configuration.nix
index 31dc38c..90eeb44 100644
--- a/nix/hosts/cc-ci/configuration.nix
+++ b/nix/hosts/cc-ci/configuration.nix
@@ -26,6 +26,10 @@
   # that bind fails ("bind source path does not exist: /etc/localtime") and the service is rejected.
   # UTC is the right default for a CI host (deterministic timestamps). ---
   time.timeZone = "UTC";
+  # Some recipes ALSO bind-mount /etc/timezone (e.g. gitea, and Debian-based images), which
+  # `time.timeZone` does NOT create (it only makes the /etc/localtime symlink). Without this the
+  # bind fails ("bind source path does not exist: /etc/timezone") and the container is rejected.
+  environment.etc."timezone".text = "UTC\n";
 
   # --- Tailscale (ACCESS-CRITICAL: do not break, this is the only route in) ---
   # Baseline read the hostname from /etc/ts-hostname at eval time; that is impure