diff --git a/Dockerfile b/Dockerfile
index cf71086..e685589 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -143,5 +143,23 @@ RUN set -eux; \
 # The patched binary replaces the stock one (see the runner-build stage).
 COPY --from=runner-build /out/forgejo-runner /bin/forgejo-runner
 
+# A passwd entry for uid 1000, the runner pod's runAsUser. Tools that look up
+# the current user (getpwuid) refuse without one: ssh-keygen -Y verify answered
+# "No user exists for uid 1000" (exit 255) once openssh-keygen was in the image,
+# so zegit's SSHSIG oracle test still failed on this runner (zegit#575).
+RUN grep -q ':x:1000:' /etc/passwd || echo 'runner:x:1000:1000:runner:/home/runner:/bin/sh' >> /etc/passwd; \
+    grep -q ':x:1000:' /etc/group || echo 'runner:x:1000:' >> /etc/group; \
+    mkdir -p /home/runner && chown 1000:1000 /home/runner
+
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000
+
+# As that user, ssh-keygen signs and verifies an SSHSIG, so a missing passwd
+# entry fails the build here, not in CI.
+RUN set -eu; d=$(mktemp -d); \
+    ssh-keygen -q -t ed25519 -N '' -f "$d/k"; \
+    echo smoke > "$d/f"; \
+    ssh-keygen -q -Y sign -n file -f "$d/k" "$d/f"; \
+    printf 'smoke %s\n' "$(cat "$d/k.pub")" > "$d/allowed"; \
+    ssh-keygen -Y verify -f "$d/allowed" -I smoke -n file -s "$d/f.sig" < "$d/f"; \
+    rm -rf "$d"