diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
index 50b0e70..23485bb 100644
--- a/.github/actions/setup-nix/action.yml
+++ b/.github/actions/setup-nix/action.yml
@@ -85,3 +85,17 @@ runs:
         paths: |
           ~/.cache/nix
           /nix
+
+    # The restore runs as root (it has to, for /nix) and extracts absolute
+    # paths, so ~/.cache is created owned by root. cache-nix-action fixes the
+    # permissions of ~/.cache/nix itself, not of its parent, and anything that
+    # creates a directory under ~/.cache then fails with AccessDenied. Zig is
+    # the one that bit us, with ~/.cache/zig.
+    - name: Fix ownership of the cache directory
+      if: ${{ inputs.cache == 'true' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        if [ -d "$HOME/.cache" ] && [ ! -w "$HOME/.cache" ]; then
+          sudo chown "$(id -u):$(id -g)" "$HOME/.cache"
+        fi
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d1560b..e428462 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,11 @@ jobs:
       - name: Check the devshell evaluates
         run: nix develop .#dev --command nix --version
 
+      # Guards the restore, which extracts as root and would otherwise leave
+      # ~/.cache unwritable for tools that create a cache there.
+      - name: Check the user cache is writable
+        run: mkdir -p "$HOME/.cache/setup-nix-smoke" && rmdir "$HOME/.cache/setup-nix-smoke"
+
       - name: Report cache
         env:
           CACHE_HIT: ${{ steps.nix.outputs.cache-hit }}