diff --git a/.gitea/workflows/install-ci-tools.sh b/.gitea/workflows/install-ci-tools.sh
index f1cdddf..988fe64 100755
--- a/.gitea/workflows/install-ci-tools.sh
+++ b/.gitea/workflows/install-ci-tools.sh
@@ -16,6 +16,10 @@ here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TOOLS_DIR="${TOOLS_DIR:-${RUNNER_TEMP:-/tmp}/homelab-tools}"
 BIN_DIR="$TOOLS_DIR/bin"
 mkdir -p "$BIN_DIR"
+# The just-installed tools must resolve inside this script too: callers only
+# prepend BIN_DIR to PATH after the script exits, so a bare `uv` below would
+# miss the binary install_uv just placed (exit 127 on a clean runner).
+export PATH="$BIN_DIR:$PATH"
 
 arch="$(uname -m)"
 # Upstream projects disagree on arch spelling: kubeconform and actionlint use
@@ -53,14 +57,31 @@ fetch() {
   fi
 }
 
+# resolve <command>
+# Absolute path to use for invoking a tool: the copy in BIN_DIR when present,
+# otherwise the name for PATH lookup. Every version check and every in-script
+# invocation goes through this, so a tool missing from both places reads as
+# "not installed" instead of dying with 127 under `set -e`.
+resolve() {
+  if [ -x "$BIN_DIR/$1" ]; then
+    printf '%s' "$BIN_DIR/$1"
+  else
+    printf '%s' "$1"
+  fi
+}
+
 # installed_version <command>
 # Prints the version of an already-installed tool, or nothing. Each tool spells
 # its version flag differently, hence the case.
 installed_version() {
-  local out
+  local bin out
+  bin="$(resolve "$1")"
+  if ! command -v "$bin" >/dev/null 2>&1; then
+    return 0
+  fi
   case "$1" in
-    kubeconform) out="$("$1" -v 2>/dev/null | head -1 || true)" ;;
-    *) out="$("$1" --version 2>/dev/null | head -1 || true)" ;;
+    kubeconform) out="$("$bin" -v 2>/dev/null | head -1 || true)" ;;
+    *) out="$("$bin" --version 2>/dev/null | head -1 || true)" ;;
   esac
   printf '%s' "$out"
 }
@@ -130,7 +151,7 @@ install_uv_tool() {
     return 0
   fi
   install_uv
-  UV_TOOL_BIN_DIR="$BIN_DIR" uv tool install --force "$1==$2" >/dev/null
+  UV_TOOL_BIN_DIR="$BIN_DIR" "$BIN_DIR/uv" tool install --force "$1==$2" >/dev/null
 }
 
 install_ruff() {