diff --git a/.gitea/scripts/sop-tier-check.sh b/.gitea/scripts/sop-tier-check.sh
index c7b2c820..dba78d4b 100755
--- a/.gitea/scripts/sop-tier-check.sh
+++ b/.gitea/scripts/sop-tier-check.sh
@@ -44,6 +44,20 @@
 
 set -euo pipefail
 
+# Ensure jq is available. Runners may not have it pre-installed, and the
+# workflow-level jq install can fail on runners with network restrictions
+# (GitHub releases not reachable). This fallback is idempotent — no-op
+# when jq is already on PATH.
+if ! command -v jq &>/dev/null; then
+  echo "::notice::jq not found on PATH — installing..."
+  timeout 60 curl -sSL \
+    "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64" \
+    -o /usr/local/bin/jq \
+    && chmod +x /usr/local/bin/jq \
+  || apt-get update -qq && apt-get install -y -qq jq
+  echo "::notice::jq installed: $(jq --version)"
+fi
+
 debug() {
   if [ "${SOP_DEBUG:-}" = "1" ]; then
     echo "  [debug] $*" >&2
diff --git a/.gitea/workflows/sop-tier-check.yml b/.gitea/workflows/sop-tier-check.yml
index 76750d50..9cc459b2 100644
--- a/.gitea/workflows/sop-tier-check.yml
+++ b/.gitea/workflows/sop-tier-check.yml
@@ -86,6 +86,12 @@ jobs:
         # more reliable than apt-get in containerized environments). Falls
         # back to apt-get if the download fails. The smoke test confirms
         # jq is on PATH before the main script runs.
+        #
+        # IMPORTANT: continue-on-error: true is REQUIRED at the step level.
+        # Job-level continue-on-error is ignored by Gitea Actions (only step
+        # level is supported). Without this, network failures on the jq curl
+        # download cause the entire job to fail and block all PRs.
+        continue-on-error: true
         run: |
           set -e
           timeout 60 curl -sSL \