diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7450a0b..7a46de1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,9 @@ jobs:
       # project confuses cargo, see rust-lang/cargo#9922). --silent uses the placeholder
       # defaults (bundle_qualifier=com, bundle_org=example).
       - name: Generate a project from the template
-        run: cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
+        run: |
+          mkdir -p "$RUNNER_TEMP/gen"
+          cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
       # No toolchain pin here: rust-toolchain.toml (copied into the generated project) is
       # the single source of truth; rustup auto-installs it on the first cargo call.
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
@@ -88,7 +90,9 @@ jobs:
         with:
           tool: cargo-generate
       - name: Generate a project from the template
-        run: cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
+        run: |
+          mkdir -p "$RUNNER_TEMP/gen"
+          cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: ${{ runner.temp }}/gen/deck-ci
@@ -117,7 +121,9 @@ jobs:
         with:
           tool: cargo-generate,cargo-deny
       - name: Generate a project from the template
-        run: cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
+        run: |
+          mkdir -p "$RUNNER_TEMP/gen"
+          cargo generate --path . --name deck-ci --silent --vcs none --destination "$RUNNER_TEMP/gen"
       - name: cargo-deny check
         working-directory: ${{ runner.temp }}/gen/deck-ci
         run: cargo deny check advisories bans sources licenses
diff --git a/src/overlay/mod.rs b/src/overlay/mod.rs
index bdf9d22..07a50f4 100644
--- a/src/overlay/mod.rs
+++ b/src/overlay/mod.rs
@@ -15,10 +15,19 @@
 //! GPUI `Global`, then `cx.notify()`. `upgrade()` returning `None` is the natural
 //! no-op after the overlay closes — no panic, no leaked task.
 
+// macOS-only in v1: the overlay windows + their objc2 panel hardening only exist on
+// macOS, so every consumer below is `#[cfg(target_os = "macos")]`. Gate the submodules
+// to match — otherwise a Linux `--features overlay` build compiles them with zero users
+// and clippy's `-D warnings` rejects the dead code. `install()` stays a no-op on Linux.
+#[cfg(target_os = "macos")]
 mod harden;
+#[cfg(target_os = "macos")]
 mod pill;
+#[cfg(target_os = "macos")]
 mod rail;
+#[cfg(target_os = "macos")]
 mod state;
+#[cfg(target_os = "macos")]
 mod status;
 
 #[cfg(target_os = "macos")]