diff --git a/.forgejo/workflows/release-iso.yml b/.forgejo/workflows/release-iso.yml
index 7191c22..a30e291 100644
--- a/.forgejo/workflows/release-iso.yml
+++ b/.forgejo/workflows/release-iso.yml
@@ -41,7 +41,10 @@ jobs:
     steps:
       - name: Install build dependencies
         run: |
-          pacman -Syu --noconfirm archiso curl python git minisign
+          # grub is required by profiledef.sh bootmodes=('uefi.grub'):
+          # mkarchiso validates grub-install on the *builder*, not the image.
+          # archiso pulls syslinux/squashfs-tools/libisoburn; it does not pull grub.
+          pacman -Syu --noconfirm archiso grub curl python git minisign
 
       - name: Determine tag and version
         id: vars
diff --git a/scripts/ci-verify-bake.sh b/scripts/ci-verify-bake.sh
index 1b01cab..d02d0b0 100755
--- a/scripts/ci-verify-bake.sh
+++ b/scripts/ci-verify-bake.sh
@@ -42,6 +42,12 @@ PY
 
 echo "== lockfile $LOCKFILE =="
 echo "   ${#REQUIRED_BINS[@]} required, ${#OPTIONAL_BINS[@]} optional"
+echo "== host tools =="
+if command -v grub-install >/dev/null 2>&1; then
+  ok "grub-install (uefi.grub bootmode)"
+else
+  bad "grub-install missing — mkarchiso uefi.grub will abort (install grub on the builder)"
+fi
 echo "== builder home $LAPTOP_HOME =="
 
 check_exec() {