diff --git a/.gitea/workflows/build-iso-linux.yaml b/.gitea/workflows/build-iso-linux.yaml
index ea27969..4b1e477 100644
--- a/.gitea/workflows/build-iso-linux.yaml
+++ b/.gitea/workflows/build-iso-linux.yaml
@@ -150,10 +150,69 @@ jobs:
           echo "iso_sha256=${A}" >> "${GITHUB_OUTPUT}"
           if [ "${A}" != "${B}" ]; then
             echo "::error::ISO SHA256 mismatch — A=${A} B=${B}"
-            ISO_A="$(ls "${{ github.workspace }}/build-a"/*.iso | head -n1)" \
-            ISO_B="$(ls "${{ github.workspace }}/build-b"/*.iso | head -n1)" \
-            REPORT_DIR="${{ github.workspace }}/divergence" \
-              linux/build/scripts/diagnose-divergence.sh
+
+            # The catthehacker job container has cmp but not diffoscope.
+            # We do have the silvermetal-builder image (with
+            # diffoscope-minimal baked in via Dockerfile.builder) on the
+            # host docker daemon — built fresh at the top of this run by
+            # the builder-image job. Run diagnose-divergence inside that
+            # image so we get the rich, package-aware diff. Mount the
+            # workspace at the same path so REPO_ROOT-relative resolution
+            # in diagnose-divergence.sh works.
+            ISO_A="$(ls "${{ github.workspace }}/build-a"/*.iso | head -n1)"
+            ISO_B="$(ls "${{ github.workspace }}/build-b"/*.iso | head -n1)"
+            mkdir -p "${{ github.workspace }}/divergence"
+
+            SELF_CID=""
+            for cid in $(docker ps -q --no-trunc 2>/dev/null); do
+              if docker inspect "$cid" --format \
+                  '{{range .Mounts}}{{if eq .Destination "/workspace/SilverLABS/SilverMetal"}}match{{end}}{{end}}' \
+                  2>/dev/null | grep -q match; then
+                SELF_CID="$cid"; break
+              fi
+            done
+            if [ -n "${SELF_CID}" ]; then
+              docker run --rm \
+                --volumes-from "${SELF_CID}" \
+                -e ISO_A="${ISO_A}" \
+                -e ISO_B="${ISO_B}" \
+                -e REPORT_DIR="${{ github.workspace }}/divergence" \
+                --entrypoint /bin/bash \
+                "${BUILDER_IMAGE}" \
+                "${{ github.workspace }}/linux/build/scripts/diagnose-divergence.sh" \
+                || true
+            else
+              echo "::warning::Could not find self container, falling back to host cmp"
+              ISO_A="${ISO_A}" ISO_B="${ISO_B}" \
+                REPORT_DIR="${{ github.workspace }}/divergence" \
+                linux/build/scripts/diagnose-divergence.sh || true
+            fi
+
+            # Tail key signal directly into the workflow log so we see it
+            # without needing artifact download (Gitea 1.25's API doesn't
+            # surface upload-artifact@v3 payloads through any v1 endpoint
+            # we've found). Print: file size diff, the checklist, and the
+            # first few hundred lines of the diffoscope text report.
+            echo ""
+            echo "=== Divergence: ISO sizes ==="
+            cat "${{ github.workspace }}/divergence/sizes.txt" 2>/dev/null || true
+            echo ""
+            echo "=== Divergence: SHA256 ==="
+            cat "${{ github.workspace }}/divergence/sha256.txt" 2>/dev/null || true
+            echo ""
+            echo "=== Divergence: checklist ==="
+            cat "${{ github.workspace }}/divergence/checklist.md" 2>/dev/null || true
+            echo ""
+            echo "=== Divergence: diffoscope (first 400 lines of diff.txt) ==="
+            head -n 400 "${{ github.workspace }}/divergence/diff.txt" 2>/dev/null || true
+            if [ ! -f "${{ github.workspace }}/divergence/diff.txt" ] \
+                && [ -f "${{ github.workspace }}/divergence/cmp.txt" ]; then
+              echo "=== Divergence: cmp -l (first 50 differing bytes) ==="
+              head -n 50 "${{ github.workspace }}/divergence/cmp.txt" 2>/dev/null || true
+            fi
+            echo ""
+            echo "(Full report uploaded as divergence-report-${{ github.run_id }})"
+
             exit 1
           fi
           echo "Reproducibility gate PASSED at ${A}"