diff --git a/.github/workflows/bootstrap-installer.yml b/.github/workflows/bootstrap-installer.yml
index 3e9a00846f..44efc2b5d0 100644
--- a/.github/workflows/bootstrap-installer.yml
+++ b/.github/workflows/bootstrap-installer.yml
@@ -26,10 +26,9 @@ jobs:
     name: install.sh sandbox install + stamp verification
     runs-on: ubuntu-24.04
     timeout-minutes: 15
-    env:
-      INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
-      HERMES_HOME: ${{ runner.temp }}/hermes-home
-      HERMES_RUNTIME_DIR: ${{ runner.temp }}/hermes-tools
+    # NOTE: `runner.temp` is only available in step-level env, not job-level
+    # env — a job-env `${{ runner.temp }}` makes GitHub reject the workflow
+    # graph at dispatch (0 jobs). Each step that needs these exports them.
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -68,6 +67,9 @@ jobs:
       - name: Run the installer stages against the PR checkout
         shell: bash
         env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
+          HERMES_HOME: ${{ runner.temp }}/hermes-home
+          HERMES_RUNTIME_DIR: ${{ runner.temp }}/hermes-tools
           HERMES_REPO_URL: ${{ steps.source.outputs.mirror }}
         run: |
           set -euo pipefail
@@ -91,6 +93,8 @@ jobs:
 
       - name: Verify the shipped version stamp
         shell: bash
+        env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
         run: |
           python3 scripts/verify-bootstrap-version-stamp.py \
             --stamp "$INSTALL_DIR/.hermes-bootstrap-complete" \
@@ -100,6 +104,8 @@ jobs:
 
       - name: The pinned commit is on the branch the installer cloned
         shell: bash
+        env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
         run: |
           # The stamp must describe the bytes actually checked out: the
           # installed repo's HEAD is exactly the commit the installer pinned.