diff --git a/README.md b/README.md
index 0f13cd6..c280f95 100644
--- a/README.md
+++ b/README.md
@@ -78,6 +78,8 @@ make run-test-dump-generator
 
 # Extract and unshield a key from a dump
 docker run --rm \
+  --cap-add=SYS_PTRACE \
+  --security-opt seccomp=unconfined \
   -e KEY_COMMENT=test@key \
   -e DUMP_PATH=/data/<dump-file>.mem \
   -v "$(pwd)/dumps:/data:ro" \
@@ -88,6 +90,11 @@ docker run --rm \
 `KEY_COMMENT` is the comment string of the target key, used to locate it in the
 dump. The recovered plaintext key is written to the mounted `/out` directory.
 
+The `--cap-add=SYS_PTRACE` and `--security-opt seccomp=unconfined` flags are
+required because the unshield step drives gdb, which makes calls into a live
+`ssh-keygen` process. gdb needs ptrace to do that; without these flags it fails
+on restricted sandboxes with `Couldn't write extended state status: Bad address`.
+
 ## Testing
 
 The parser has structural unit tests (Go's `testing` package) covering the ELF
diff --git a/entrypoint.sh b/entrypoint.sh
index dc92897..d27692f 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# docker run -e KEY_COMMENT=test@key -e DUMP_PATH=/data/cf87158b-7e71-4552-a0a4-2d941010e12f.mem -v $(pwd)/dumps:/data:ro -v $(pwd)/dumps:/out:ro shieldbreak
+# docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -e KEY_COMMENT=test@key -e DUMP_PATH=/data/cf87158b-7e71-4552-a0a4-2d941010e12f.mem -v $(pwd)/dumps:/data:ro -v $(pwd)/dumps:/out:ro shieldbreak
 
 set -eu
 
diff --git a/test/run-test.sh b/test/run-test.sh
index e83c12b..8b52f49 100755
--- a/test/run-test.sh
+++ b/test/run-test.sh
@@ -31,7 +31,14 @@ docker run --rm --privileged \
 	ssh-agent-test-dump-generator
 
 echo "[*] Extracting and unshielding the key"
+# The unshield step drives gdb, which makes inferior calls into a live
+# ssh-keygen process. That needs ptrace (to save/restore the inferior's register
+# state and to disable ASLR), so grant SYS_PTRACE and relax seccomp. Without
+# these the run is flaky: it works where the host allows the ptrace calls and
+# fails on restricted sandboxes such as GitHub Actions runners.
 docker run --rm \
+	--cap-add=SYS_PTRACE \
+	--security-opt seccomp=unconfined \
 	-e KEY_COMMENT="$KEY_COMMENT" \
 	-e DUMP_PATH="/data/${DUMP_FILE}" \
 	-v "$DUMPS_DIR:/data:ro" \