diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2e8520f..42bb163 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,12 +21,22 @@ jobs:
       # and MP4 fixtures with ffmpeg, and signal_bot/media_strip.py strips
       # metadata with exiftool. Verified rather than trusted, because an
       # apt exit code is not the same claim as "the binary resolves".
-      - name: Install ffmpeg and exiftool
+      # Every binary tool/e2e_fixtures.py shells out to, which is the whole
+      # list rather than the first one that failed: ffmpeg builds the JPEG
+      # and MP4 fixtures, heif-enc the HEIC one, and exiftool is what
+      # signal_bot/media_strip.py strips metadata with. scripts/e2e.sh has
+      # needed all three since it was written and this file installed none of
+      # them, which is why CI has been red on every commit.
+      #
+      # Verified by resolving each binary, not by trusting apt's exit code --
+      # the same distinction install_service.sh makes for the host.
+      - name: Install the tools the fixtures are built with
         run: |
           sudo apt-get update
-          sudo apt-get install -y ffmpeg libimage-exiftool-perl
-          ffmpeg -version | head -1
-          exiftool -ver
+          sudo apt-get install -y ffmpeg libimage-exiftool-perl libheif-examples
+          for tool in ffmpeg exiftool heif-enc; do
+            command -v "$tool" || { echo "::error::$tool did not resolve"; exit 1; }
+          done
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5