diff --git a/.github/actions/nix-setup/action.yml b/.github/actions/nix-setup/action.yml
index 0aeaf918..7ee7ddb0 100644
--- a/.github/actions/nix-setup/action.yml
+++ b/.github/actions/nix-setup/action.yml
@@ -10,6 +10,22 @@ inputs:
 runs:
   using: composite
   steps:
+    # cachix-action requires the USER env var. It shells out to
+    # `nix-env -iA cachix` and `cachix use`, both of which expect
+    # HOME + USER set on the caller (Nix uses USER to scope per-user
+    # profile dirs). On act_runner the job container does not
+    # propagate USER from the host, so cachix fails with:
+    #
+    #   $USER must be set. If running in a container, try setting USER=root.
+    #
+    # Export USER once at the top of this composite so every
+    # subsequent Nix-using step inherits it.
+    - name: Ensure USER is set (act_runner / container compat)
+      shell: bash
+      run: |
+        if [ -z "${USER:-}" ]; then
+          echo "USER=$(id -un 2>/dev/null || echo root)" >> "$GITHUB_ENV"
+        fi
     - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
     - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
       with: