diff --git a/.buildkite/steps/common.sh b/.buildkite/steps/common.sh
index c50ef9d16..6ee3499c8 100644
--- a/.buildkite/steps/common.sh
+++ b/.buildkite/steps/common.sh
@@ -25,5 +25,11 @@ fi
 # shellcheck disable=SC1091
 [ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
 
+# Export toolchain homes explicitly so the unprivileged re-exec in test.sh can
+# inherit them; rustup's default HOME-relative paths do not survive a user swap.
+export CARGO_HOME="${CARGO_HOME:-$HOME/.cargo}"
+export RUSTUP_HOME="${RUSTUP_HOME:-$HOME/.rustup}"
+export PATH="$CARGO_HOME/bin:$PATH"
+
 cargo --version
 rustc --version
diff --git a/.buildkite/steps/test.sh b/.buildkite/steps/test.sh
index e50256041..f00bf1176 100755
--- a/.buildkite/steps/test.sh
+++ b/.buildkite/steps/test.sh
@@ -10,8 +10,41 @@ if ! command -v cargo-nextest >/dev/null 2>&1; then
   cargo install cargo-nextest --locked --version 0.9.* || cargo install cargo-nextest --locked
 fi
 
-echo "--- workspace tests"
-cargo nextest run --workspace --all-features --locked --profile ci
+# Hosted Linux agents run the job as root. That is not equivalent to GitHub's
+# `runner` user: root ignores permission bits, so every test that makes a path
+# read-only and asserts the write is refused instead *succeeds* at writing and
+# fails the assertion. Build 1443 failed exactly four tests this way --
+# an_unwritable_home_reports_the_failure_and_still_answers,
+# contract_edit_rejects_read_only_target_before_atomic_replace,
+# failed_apply_rolls_back_to_the_prior_document, and one fleet executor case --
+# none of which are product defects.
+#
+# Drop to an unprivileged user rather than skipping them: those tests guard
+# data-loss and permission behaviour, and a CI lane that silently cannot
+# exercise them is a weaker gate reporting green.
+run_suite() {
+  echo "--- workspace tests"
+  cargo nextest run --workspace --all-features --locked --profile ci
+  echo "--- doctests"
+  cargo test --workspace --all-features --locked --doc
+}
 
-echo "--- doctests"
-cargo test --workspace --all-features --locked --doc
+if [ "$(id -u)" = "0" ] && [ "$(uname -s)" = "Linux" ]; then
+  id -u builder >/dev/null 2>&1 || useradd -m -s /bin/bash builder
+  chown -R builder:builder . "$CARGO_HOME" "$RUSTUP_HOME" 2>/dev/null || true
+  echo "--- re-exec as unprivileged user (root ignores permission bits)"
+  exec runuser -u builder -- env \
+    PATH="$PATH" CARGO_HOME="$CARGO_HOME" RUSTUP_HOME="$RUSTUP_HOME" \
+    CARGO_TERM_COLOR="${CARGO_TERM_COLOR:-always}" \
+    CARGO_INCREMENTAL="${CARGO_INCREMENTAL:-0}" \
+    RUST_MIN_STACK="${RUST_MIN_STACK:-16777216}" \
+    bash -eo pipefail -c '
+      cd "$1"
+      echo "--- workspace tests (uid $(id -u))"
+      cargo nextest run --workspace --all-features --locked --profile ci
+      echo "--- doctests"
+      cargo test --workspace --all-features --locked --doc
+    ' _ "$PWD"
+fi
+
+run_suite