diff --git a/.config/tend.yaml b/.config/tend.yaml
index 69751644747d..9b1d8a978353 100644
--- a/.config/tend.yaml
+++ b/.config/tend.yaml
@@ -10,6 +10,31 @@ secrets:
     - DOCKERHUB_USERNAME
 setup:
   - uses: ./.github/actions/tend-setup
+# cargo-insta and cargo-nextest are used only by the agent, never by a
+# runner-side step. `tend-setup` used to install them with `cargo-install`,
+# under the *runner* user's home — which tend deliberately keeps off the sandbox
+# PATH, since that home can hold credentials — so the agent got a stub that
+# exits 127. Install them under the sandbox user's home instead, which is what
+# that stub asks for. Both ship prebuilt binaries, so this downloads rather than
+# builds (~1s for the pair).
+#
+# `~/.local/bin` rather than the cargo default: it is first on the sandbox PATH,
+# ahead of both `~/.tend-blocked/bin` (where the 127 stubs live) and
+# `~/.cargo/bin`. Hence `CARGO_HOME` on the cargo-dist installer, which places
+# the binary at `$CARGO_HOME/bin`.
+#
+# Without this, `task prqlc:test` — the inner loop `CLAUDE.md` documents —
+# aborts in every tend session. `task prqlc:pull-request` needs more: it also
+# reaches `cargo llvm-cov` and `pre-commit`, neither of which is on the sandbox
+# PATH at all.
+sandbox_setup:
+  - mkdir -p ~/.local/bin
+  - curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+  - cargo-nextest --version
+  - curl -LsSf
+    https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh
+    | CARGO_HOME=~/.local sh
+  - cargo-insta --version
 workflows:
   ci-fix:
     watched_workflows:
diff --git a/.github/actions/tend-setup/action.yaml b/.github/actions/tend-setup/action.yaml
index 0b69a0b30b17..ad9d1d52f919 100644
--- a/.github/actions/tend-setup/action.yaml
+++ b/.github/actions/tend-setup/action.yaml
@@ -17,14 +17,6 @@ runs:
         repo-token: ${{ inputs.github-token }}
         version: 3.53.1
 
-    - uses: baptiste0928/cargo-install@v3
-      with:
-        crate: cargo-insta
-
-    - uses: baptiste0928/cargo-install@v3
-      with:
-        crate: cargo-nextest
-
     - run: ./.github/workflows/scripts/set_version.sh
       shell: bash
 
diff --git a/.github/workflows/tend-ci-fix.yaml b/.github/workflows/tend-ci-fix.yaml
index 3e75043c8325..98f4c5751a4a 100644
--- a/.github/workflows/tend-ci-fix.yaml
+++ b/.github/workflows/tend-ci-fix.yaml
@@ -41,6 +41,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:ci-fix ${{ github.event.workflow_run.id }}
             - Run URL: ${{ github.event.workflow_run.html_url }}
diff --git a/.github/workflows/tend-mention.yaml b/.github/workflows/tend-mention.yaml
index 58888cd98fe6..e008c17b6d3a 100644
--- a/.github/workflows/tend-mention.yaml
+++ b/.github/workflows/tend-mention.yaml
@@ -427,6 +427,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: >-
             ${{ steps.delay.outputs.seconds
             && format('This job started {0}s after the triggering event (over ~40s means it was queued). ',
diff --git a/.github/workflows/tend-nightly.yaml b/.github/workflows/tend-nightly.yaml
index 47b8b5959ff2..6111d7d778bc 100644
--- a/.github/workflows/tend-nightly.yaml
+++ b/.github/workflows/tend-nightly.yaml
@@ -41,5 +41,11 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:nightly
diff --git a/.github/workflows/tend-notifications.yaml b/.github/workflows/tend-notifications.yaml
index a5311ee3a957..46e642467ee7 100644
--- a/.github/workflows/tend-notifications.yaml
+++ b/.github/workflows/tend-notifications.yaml
@@ -131,6 +131,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:notifications
 
diff --git a/.github/workflows/tend-review-runs.yaml b/.github/workflows/tend-review-runs.yaml
index 4344e28dde3c..a5252a534143 100644
--- a/.github/workflows/tend-review-runs.yaml
+++ b/.github/workflows/tend-review-runs.yaml
@@ -41,5 +41,11 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:review-runs
diff --git a/.github/workflows/tend-review.yaml b/.github/workflows/tend-review.yaml
index d41fa4a0165b..058e48d57551 100644
--- a/.github/workflows/tend-review.yaml
+++ b/.github/workflows/tend-review.yaml
@@ -84,6 +84,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:review ${{ github.event.pull_request.number }}
 
diff --git a/.github/workflows/tend-triage.yaml b/.github/workflows/tend-triage.yaml
index ece079ec6041..d2e641995787 100644
--- a/.github/workflows/tend-triage.yaml
+++ b/.github/workflows/tend-triage.yaml
@@ -53,6 +53,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:triage ${{ github.event.issue.number }}
 
diff --git a/.github/workflows/tend-weekly.yaml b/.github/workflows/tend-weekly.yaml
index 9d2f747c71ce..2bb5719dcf02 100644
--- a/.github/workflows/tend-weekly.yaml
+++ b/.github/workflows/tend-weekly.yaml
@@ -41,5 +41,11 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:weekly