diff --git a/cspell.config.yaml b/cspell.config.yaml
index 90a6ae88ed..32576cc54b 100644
--- a/cspell.config.yaml
+++ b/cspell.config.yaml
@@ -134,6 +134,7 @@ words:
   - iou
   - ious
   - isrdc
+  - isystem
   - itype
   - jemalloc
   - jlog
diff --git a/docker/check-tools.sh b/docker/check-tools.sh
index faa4586832..eb72e8f357 100755
--- a/docker/check-tools.sh
+++ b/docker/check-tools.sh
@@ -8,11 +8,13 @@ clang++ --version
 clang-format --version
 cmake --version
 conan --version
+curl --version
 g++ --version
 gcc --version
 gcov --version
 gcovr --version
 git --version
+gpg --version
 less --version
 make --version
 mold --version
diff --git a/docker/test_files/cpp_sources/asan.cpp b/docker/test_files/cpp_sources/asan.cpp
index 8347f58d37..deefdec79a 100644
--- a/docker/test_files/cpp_sources/asan.cpp
+++ b/docker/test_files/cpp_sources/asan.cpp
@@ -2,6 +2,13 @@
 #include <cstddef>
 #include <iostream>
 
+// Regression test: the compiler-rt sanitizer interface headers must be on the
+// include path. A bare on-PATH clang in the Nix CI env doesn't get them
+// propagated automatically, so this include would fail to compile with clang++
+// if the env isn't wired up correctly. abseil hits the same include during
+// sanitizer builds. LeakSanitizer ships with AddressSanitizer.
+#include <sanitizer/lsan_interface.h>
+
 #if defined(__clang__) || defined(__GNUC__)
 __attribute__((noinline))
 #elif defined(_MSC_VER)
diff --git a/nix/ci-env.nix b/nix/ci-env.nix
index 0ef7410250..f823f71de0 100644
--- a/nix/ci-env.nix
+++ b/nix/ci-env.nix
@@ -94,6 +94,14 @@ let
       ln -s "${customCompilerRt.out}/lib" "$rsrc/lib"
       ln -s "${customCompilerRt.out}/share" "$rsrc/share" || true
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+      # compiler-rt ships the sanitizer/profile/xray interface headers (e.g.
+      # <sanitizer/lsan_interface.h>) in its `dev` output. In a normal Nix
+      # build these reach the include path because compiler-rt is propagated
+      # via depsTargetTargetPropagated and stdenv's setup hooks add its
+      # dev/include. The CI image runs clang outside a Nix stdenv (binaries
+      # on PATH, no setup hooks), so that never happens; add the headers
+      # explicitly. gcc ships its own copy, which is why this is clang-only.
+      echo "-isystem ${customCompilerRt.dev}/include" >> $out/nix-support/cc-cflags
     '';
   };
 
diff --git a/nix/packages.nix b/nix/packages.nix
index b608677aea..f282c15df9 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -11,9 +11,11 @@ in
     ccache
     cmake
     conan
+    curlMinimal # needed for codecov/codecov-action
     gcovr
     git
     gnumake
+    gnupg # needed for signing commits & codecov/codecov-action
     llvmPackages_22.clang-tools
     less # needed for git diff
     mold