diff --git a/.gitea/workflows/unit-tests.yml b/.gitea/workflows/unit-tests.yml
index 5ffd1f4..6c18792 100644
--- a/.gitea/workflows/unit-tests.yml
+++ b/.gitea/workflows/unit-tests.yml
@@ -40,7 +40,7 @@ jobs:
     # bumping the tag in scripts/ci/build_builder_image.sh AND here, in one
     # commit -- see that script's header.
     container:
-      image: gitea.tourolle.paris/dtourolle/sae-builder-cpu:v2
+      image: gitea.tourolle.paris/dtourolle/sae-builder-cpu:v3
 
     steps:
       - name: Checkout repository
@@ -73,8 +73,8 @@ jobs:
           # line above and the image that actually landed disagree, which is
           # exactly the drift the pinning exists to prevent -- so it fails the
           # job rather than building against an unknown toolchain.
-          [ "$SAE_BUILDER_VERSION" = "v2" ] || {
-            echo "image reports version '$SAE_BUILDER_VERSION', workflow pins v2" >&2
+          [ "$SAE_BUILDER_VERSION" = "v3" ] || {
+            echo "image reports version '$SAE_BUILDER_VERSION', workflow pins v3" >&2
             exit 1
           }
 
diff --git a/Dockerfile.builder-cpu b/Dockerfile.builder-cpu
index a111b92..1203e46 100644
--- a/Dockerfile.builder-cpu
+++ b/Dockerfile.builder-cpu
@@ -92,6 +92,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     ca-certificates \
     curl \
+    # unzip is not optional here: the T2 replay fixtures ship as a zip in the
+    # generic package registry and scripts/artifacts/pull_artifacts.sh unpacks
+    # them with it. Without unzip that step exits 127 and the replay tier has no
+    # input -- which is a missing tool reported as a missing fixture.
+    unzip \
     # Gitea's act_runner executes JS actions (actions/checkout, upload-artifact)
     # with the `node` found *inside* the container. Without this the job cannot
     # even check the repository out. Same reason as the kpnpp-builder image.
diff --git a/scripts/ci/build_builder_image.sh b/scripts/ci/build_builder_image.sh
index 7c59150..f051a10 100644
--- a/scripts/ci/build_builder_image.sh
+++ b/scripts/ci/build_builder_image.sh
@@ -5,9 +5,9 @@
 # TRACES: DP-007 | PR-004
 #
 # Usage:
-#   scripts/ci/build_builder_image.sh                  # build only, tag v2
+#   scripts/ci/build_builder_image.sh                  # build only, tag v3
 #   scripts/ci/build_builder_image.sh --push           # build and push
-#   scripts/ci/build_builder_image.sh --tag v3 --push  # bump the pinned tag
+#   scripts/ci/build_builder_image.sh --tag v4 --push  # bump the pinned tag
 #   scripts/ci/build_builder_image.sh --no-cache       # force a clean rebuild
 #
 # The tag is the contract with CI. .gitea/workflows/unit-tests.yml names an
@@ -35,9 +35,10 @@ DOCKERFILE="Dockerfile.builder-cpu"
 # image it landed in reports this same version, so a drift shows up as a failed
 # job rather than as a build against the wrong toolchain.
 #
-# v2 adds libfftw3-dev: the learned scene-boundary detector's find_library is
+# v2 added libfftw3-dev: the learned scene-boundary detector's find_library is
 # REQUIRED at configure time, so v1 cannot configure this repository at all.
-TAG="v2"
+# v3 adds unzip, which pull_artifacts.sh needs to unpack the replay fixtures.
+TAG="v3"
 
 PUSH=0
 EXTRA_ARGS=()