diff --git a/swarm-queue-client/src/lib.rs b/swarm-queue-client/src/lib.rs
index e998648d..b5c3b193 100644
--- a/swarm-queue-client/src/lib.rs
+++ b/swarm-queue-client/src/lib.rs
@@ -579,9 +579,29 @@ mod tests {
     /// This asserts the *shape of the request* rather than a server's reply,
     /// which is the whole point: it fails on the old code with no identity
     /// provider, no deployment and no network.
+    /// A client for inspecting a request, never for sending one.
+    ///
+    /// 🩸 `reqwest::Client::new()` **panics in the nix build sandbox**, which
+    /// has no system CA store: `ClientBuilder::build()` reaches
+    /// `rustls_platform_verifier::Verifier::new()` and fails with "No CA
+    /// certificates were loaded from the system", and `new()` is
+    /// `build().expect(..)`. The test passed locally — a devshell has
+    /// `/etc/ssl/certs` — and failed in CI.
+    ///
+    /// Turning verification off takes the `!certs_verification` branch, which
+    /// installs a no-op verifier and never consults the platform store, so
+    /// this builds anywhere. It is sound *here specifically* because nothing
+    /// is ever sent: the request is built and its bytes inspected.
+    fn offline_client() -> reqwest::Client {
+        reqwest::Client::builder()
+            .danger_accept_invalid_certs(true)
+            .build()
+            .expect("a client that verifies nothing needs no system trust store")
+    }
+
     #[test]
     fn the_token_request_authenticates_with_http_basic() {
-        let req = token_request(&reqwest::Client::new(), &token_cfg(), "s3cret")
+        let req = token_request(&offline_client(), &token_cfg(), "s3cret")
             .build()
             .expect("the token request must build");