diff --git a/.gitea/workflows/sp-live-image.yml b/.gitea/workflows/sp-live-image.yml
index c45d93e..ce07350 100644
--- a/.gitea/workflows/sp-live-image.yml
+++ b/.gitea/workflows/sp-live-image.yml
@@ -48,12 +48,14 @@ jobs:
       image: debian:trixie-slim
     steps:
       - name: Install CI dependencies
-        # `nodejs` is for act_runner's JavaScript actions, not for us - see ci.yml.
+        # `nodejs` is for act_runner's JavaScript actions, not for us - see ci.yml. `unzip` is for
+        # 1password/load-secrets-action, which unpacks its CLI with it and fails with exit 127
+        # without it.
         run: |
           set -eu
           apt-get update -qq
           apt-get install -y --no-install-recommends \
-            git nodejs curl docker-cli docker-buildx ca-certificates iproute2 gawk
+            git nodejs curl docker-cli docker-buildx unzip ca-certificates iproute2 gawk
 
       - uses: actions/checkout@v7