diff --git a/scripts/provision-ci-runner.sh b/scripts/provision-ci-runner.sh
index 4410203..cff1918 100755
--- a/scripts/provision-ci-runner.sh
+++ b/scripts/provision-ci-runner.sh
@@ -270,11 +270,18 @@ docker exec "$PROBE_CONTAINER" docker info --format '{{range .SecurityOptions}}{
 # Complete every slow and capability-sensitive validation before registration;
 # otherwise a queued workflow can race the installer for the same image layers.
 docker exec "$PROBE_CONTAINER" docker pull "$JOB_IMAGE"
-outer_pidns=$(docker exec "$PROBE_CONTAINER" readlink /proc/1/ns/pid)
-inner_host_pidns=$(docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
-  --pid=host --entrypoint readlink "$JOB_IMAGE" /proc/1/ns/pid)
-[ "$outer_pidns" != "$inner_host_pidns" ] || \
+outer_sentinel_pid=$(docker exec "$PROBE_CONTAINER" /bin/sh -c \
+  'sleep 300 >/dev/null 2>&1 & printf "%s\n" "$!"')
+case $outer_sentinel_pid in
+  '' | *[!0-9]*) fail "could not create the outer PID namespace sentinel" ;;
+esac
+if ! docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
+  --pid=host --entrypoint /bin/sh "$JOB_IMAGE" \
+  -ec 'test ! -e "/proc/$1"' sh "$outer_sentinel_pid"; then
+  docker exec "$PROBE_CONTAINER" kill "$outer_sentinel_pid" >/dev/null 2>&1 || true
   fail "nested --pid=host can see the outer runner PID namespace"
+fi
+docker exec "$PROBE_CONTAINER" kill "$outer_sentinel_pid" >/dev/null 2>&1 || true
 docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
   --volume "$PREFIX:$PREFIX:ro" \
   --entrypoint /bin/sh "$JOB_IMAGE" -ec '