diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 9b8805f..0eff6d4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -26,8 +26,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install mise
+      # The repo's mise.toml pulls the whole dev toolchain (tailwind, cargo-watch,
+      # flyctl, shellcheck, ...), and mise resolves most of those via the GitHub
+      # API — which 401s on this runner (it has no github.com token), failing the
+      # entire install. CI only needs the pinned Rust toolchain, so install it
+      # directly via mise (rust resolves through rustup, no GitHub API).
+      - name: Install Rust toolchain
         uses: https://github.com/jdx/mise-action@v2
+        with:
+          install_args: rust
 
       - name: Cache Cargo artifacts
         uses: actions/cache@v4
@@ -42,11 +49,10 @@ jobs:
             cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
             cargo-${{ runner.os }}-
 
+      # No sudo on the node:20-bookworm runner image (job runs as root). mold is
+      # required by .cargo/config.toml's linker flag (-fuse-ld=mold).
       - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y clang lld mold libssl-dev pkg-config
-
-      - name: Ensure Rust components
-        run: rustup component add rustfmt clippy
+        run: apt-get update && apt-get install -y --no-install-recommends clang lld mold pkg-config
 
       - name: Check formatting
         run: cargo fmt -- --check