diff --git a/.forgejo/workflows/apple-distribute-testers.yml b/.forgejo/workflows/apple-distribute-testers.yml
index ac39f46..3cc3121 100644
--- a/.forgejo/workflows/apple-distribute-testers.yml
+++ b/.forgejo/workflows/apple-distribute-testers.yml
@@ -192,9 +192,14 @@ jobs:
             bazel_args+=("--bazelrc=${BURROW_BAZEL_NSCCACHE_BAZELRC}")
           fi
           NIX_BIN="$(bash Scripts/ci/resolve-nix-bin.sh)"
+          ci_path="$("$NIX_BIN" develop .#ci --command bash -lc 'printf "%s" "$PATH"')"
+          ci_protoc="$("$NIX_BIN" develop .#ci --command bash -lc 'command -v protoc')"
           "$NIX_BIN" develop .#ci --command bazel "${bazel_args[@]}" build \
             --verbose_failures \
             --show_timestamps \
+            --experimental_ui_max_stdouterr_bytes=16777216 \
+            --action_env=PATH="$ci_path" \
+            --action_env=PROTOC="$ci_protoc" \
             --action_env=BUILD_WORKSPACE_DIRECTORY="$PWD" \
             --action_env=BUILD_NUMBER="$BUILD_NUMBER" \
             --action_env=BURROW_RELEASE_OUT="$PWD/dist/builds/$BUILD_NUMBER" \
@@ -286,9 +291,14 @@ jobs:
             bazel_args+=("--bazelrc=${BURROW_BAZEL_NSCCACHE_BAZELRC}")
           fi
           NIX_BIN="$(bash Scripts/ci/resolve-nix-bin.sh)"
+          ci_path="$("$NIX_BIN" develop .#ci --command bash -lc 'printf "%s" "$PATH"')"
+          ci_protoc="$("$NIX_BIN" develop .#ci --command bash -lc 'command -v protoc')"
           "$NIX_BIN" develop .#ci --command bazel "${bazel_args[@]}" build \
             --verbose_failures \
             --show_timestamps \
+            --experimental_ui_max_stdouterr_bytes=16777216 \
+            --action_env=PATH="$ci_path" \
+            --action_env=PROTOC="$ci_protoc" \
             --action_env=BUILD_WORKSPACE_DIRECTORY="$PWD" \
             --action_env=BUILD_NUMBER="$BUILD_NUMBER" \
             --action_env=BURROW_RELEASE_OUT="$PWD/dist/builds/$BUILD_NUMBER" \
diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
index 174aceb..fbfb016 100644
--- a/.forgejo/workflows/build-release.yml
+++ b/.forgejo/workflows/build-release.yml
@@ -335,9 +335,14 @@ jobs:
           fi
 
           NIX_BIN="$(bash Scripts/ci/resolve-nix-bin.sh)"
+          ci_path="$("$NIX_BIN" develop .#ci --command bash -lc 'printf "%s" "$PATH"')"
+          ci_protoc="$("$NIX_BIN" develop .#ci --command bash -lc 'command -v protoc')"
           "$NIX_BIN" develop .#ci --command bazel "${bazel_args[@]}" build \
             --verbose_failures \
             --show_timestamps \
+            --experimental_ui_max_stdouterr_bytes=16777216 \
+            --action_env=PATH="$ci_path" \
+            --action_env=PROTOC="$ci_protoc" \
             --action_env=BUILD_WORKSPACE_DIRECTORY="$PWD" \
             --action_env=BUILD_NUMBER="$BUILD_NUMBER" \
             --action_env=BURROW_RELEASE_OUT="$PWD/dist/builds/$BUILD_NUMBER" \
diff --git a/Apple/NetworkExtension/libburrow/build-rust.sh b/Apple/NetworkExtension/libburrow/build-rust.sh
index 07ec038..81cb901 100755
--- a/Apple/NetworkExtension/libburrow/build-rust.sh
+++ b/Apple/NetworkExtension/libburrow/build-rust.sh
@@ -84,12 +84,20 @@ else
 fi
 
 if [[ -x "$(command -v rustup)" ]]; then
-    CARGO_PATH="$(dirname $(rustup which cargo)):/usr/bin"
+    CARGO_PATH="$(dirname "$(rustup which cargo)"):/usr/bin"
 else
-    CARGO_PATH="$(dirname $(readlink -f $(which cargo))):/usr/bin"
+    CARGO_PATH="$(dirname "$(command -v cargo)"):/usr/bin"
 fi
 
-PROTOC=$(readlink -f $(which protoc))
+if [[ -n "${PROTOC:-}" ]]; then
+    if [[ ! -x "$PROTOC" ]]; then
+        echo "error: PROTOC is set but is not executable: $PROTOC" >&2
+        exit 127
+    fi
+elif ! PROTOC="$(command -v protoc 2>/dev/null)"; then
+    echo 'error: Unable to find protoc; pass PROTOC or include it in PATH for the Xcode Rust build phase' >&2
+    exit 127
+fi
 CARGO_PATH="$(dirname $PROTOC):$CARGO_PATH"
 
 # Run cargo without the various environment variables set by Xcode.
diff --git a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
index 56847b2..b496045 100644
--- a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
+++ b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
@@ -68,6 +68,9 @@ The same change also makes the forge itself the release authority: release tags
 - Bazel repository and disk caches must live outside the checked-out repository
   on macOS runners. Bazel 9 rejects a repository contents cache inside the main
   repo because it can create spurious build graph failures.
+- Bazel Apple genrules must explicitly pass the Nix CI shell tool path and
+  `PROTOC` into the action environment. Xcode build phases run with a reduced
+  path, and the Rust Network Extension build depends on `protoc`.
 - Produce unsigned Apple validation artifacts when signing is absent, but require signing for an App Store requested iOS release and for a Sparkle tester release. Uploadable artifacts are produced only after provisioning profiles can be synced from App Store Connect credentials and the relevant Apple certificate is proven to match the selected Google KMS key.
 - Resolve release credentials through age/agenix before signed Apple lanes run. Forgejo secrets should carry only the runner age identity fallback and the Authentik WIF client secret until OpenBao can mint the runner token directly. App Store Connect keys and signing certificates live as sealed files under `secrets/`.
 - Persist the forge runner SSH key as `/var/lib/forgejo-runner-agent/age_keystore` and export `BURROW_RUNNER_AGE_IDENTITY_PATH` so jobs can resolve agenix identities without embedding long-lived material in every workflow.