diff --git a/.github/workflows/csharp-server.yml b/.github/workflows/csharp-server.yml
index 1d953de..396449b 100644
--- a/.github/workflows/csharp-server.yml
+++ b/.github/workflows/csharp-server.yml
@@ -9,10 +9,6 @@ jobs:
   build-and-test:
     name: Repository policy, C# build and test
     runs-on: [self-hosted, Linux, X64]
-    # The self-hosted runner user cannot write to the system /usr/share/dotnet,
-    # so install the pinned SDK into a runner-writable (and cached) path instead.
-    env:
-      DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
     steps:
       - uses: actions/checkout@v4
 
@@ -20,6 +16,11 @@ jobs:
         run: bash server/scripts/verify-no-legacy-runtime.sh
 
       - uses: actions/setup-dotnet@v4
+        # The runner user cannot write to system /usr/share/dotnet; install the
+        # pinned SDK into a runner-writable, cached path instead. runner.* context
+        # is only valid at step scope, not job-level env.
+        env:
+          DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
         with:
           dotnet-version: "8.0.x"