diff --git a/.gitea/workflows/repro.yaml b/.gitea/workflows/repro.yaml
new file mode 100644
index 0000000..a960b52
--- /dev/null
+++ b/.gitea/workflows/repro.yaml
@@ -0,0 +1,44 @@
+name: CI repro (readLinkAt)
+
+# Throwaway workflow to reproduce the determinate-nix `readLinkAt.works` unit
+# test failure seen in the master CI build, and capture the full gtest log.
+# Runs only on this branch; delete the branch when done.
+
+on:
+  push:
+    branches: [ci-repro-readlinkat]
+
+jobs:
+  repro:
+    name: Reproduce determinate-nix test failure
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@v6
+      - uses: DeterminateSystems/determinate-nix-action@v3
+        with:
+          github-token: ${{ secrets.GH_PULL_TOKEN }}
+          extra-conf: |
+            sandbox-fallback = false
+            cores = 6
+
+            lazy-trees = true
+            eval-cores = 0
+
+            accept-flake-config = true
+            extra-substituters = https://nix-cache.nul.ie
+            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
+
+      - name: Build devshell with full logs
+        run: |
+          set -eo pipefail
+          # -L prints full build logs inline (including the gtest assertion that
+          # fails); --keep-going surfaces the failure without aborting early.
+          # determinate-nix isn't in the cache yet (the failing master run never
+          # pushed it), so this rebuilds it and reruns the unit tests.
+          nix build -L --keep-going --no-link .#ci.x86_64-linux.shell 2>&1 | tee repro.log
+
+      - name: Show failing assertion
+        if: failure()
+        run: |
+          echo "===== readLinkAt / gtest failure detail ====="
+          grep -nE 'FAILED|readLinkAt|Failure|Expected|Actual|Value of|which is|error:' repro.log || true