diff --git a/.github/workflows/compile-all.yaml b/.github/workflows/compile-all.yaml
index 9eebf23..076a48e 100644
--- a/.github/workflows/compile-all.yaml
+++ b/.github/workflows/compile-all.yaml
@@ -20,6 +20,8 @@ jobs:
           cp secrets.yaml.sample secrets.yaml
           cp templates/secrets.yaml.sample templates/secrets.yaml
 
+      # Uses the ci shell, which installs esphome via pipx at the exact version
+      # pinned in Nix. The ci shell avoids nixpkgs wrapping platformio in bwrap,
+      # which fails on CI runners that disallow unprivileged user namespaces.
       - name: Compile All
-        run: |
-          nix develop --command make compile-all -j4
+        run: nix develop .#ci --command make compile-all -j4
diff --git a/flake.nix b/flake.nix
index ced8e19..fa79931 100644
--- a/flake.nix
+++ b/flake.nix
@@ -56,6 +56,25 @@
               esphome --version
             '';
           };
+
+          # CI shell: uses the same esphome version as default, but installs it
+          # via pipx to avoid nixpkgs wrapping platformio in bwrap, which fails
+          # on CI runners that disallow unprivileged user namespaces.
+          ci = pkgs.mkShell {
+            buildInputs = with pkgs; [
+              python3
+              python3Packages.pipx
+              esptool
+              gnumake
+            ];
+
+            shellHook = ''
+              pipx install --quiet esphome==${pkgs.esphome.version}
+              export PATH="$HOME/.local/bin:$PATH"
+              echo -n "ESPHome (CI) "
+              esphome --version
+            '';
+          };
         }
       );
     };