diff --git a/.forgejo/workflows/build-images.yml b/.forgejo/workflows/build-images.yml
index 358399b..7817c7e 100644
--- a/.forgejo/workflows/build-images.yml
+++ b/.forgejo/workflows/build-images.yml
@@ -26,8 +26,12 @@ jobs:
         run: |
           set -euo pipefail
           apt-get update
+          # Debian trixie: `docker.io` only installs the daemon; the CLI
+          # (`/usr/bin/docker`) ships in `docker-cli`, which is a Recommends
+          # and therefore excluded by `--no-install-recommends`. Add it
+          # explicitly.
           apt-get install -y --no-install-recommends \
-            git curl ca-certificates docker.io
+            git curl ca-certificates docker.io docker-cli
           git --version
           docker --version
 
diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
index f900acd..3bbc850 100644
--- a/.forgejo/workflows/validate.yml
+++ b/.forgejo/workflows/validate.yml
@@ -178,8 +178,11 @@ jobs:
         run: |
           set -euo pipefail
           apt-get update
+          # Debian trixie: `docker.io` only brings the daemon; the CLI
+          # (`/usr/bin/docker`) ships in `docker-cli` as a Recommends that
+          # `--no-install-recommends` skips. Pull it in explicitly.
           apt-get install -y --no-install-recommends \
-            git curl ca-certificates docker.io postgresql-client
+            git curl ca-certificates docker.io docker-cli postgresql-client
           git --version
           docker --version
           psql --version