diff --git a/.github/actions/install-apt-deps/action.yml b/.github/actions/install-apt-deps/action.yml
index 0f7bce22e1..5f692100c4 100644
--- a/.github/actions/install-apt-deps/action.yml
+++ b/.github/actions/install-apt-deps/action.yml
@@ -24,7 +24,7 @@ inputs:
     description: >
       Tag of a prebuilt .deb bundle published to
       ghcr.io/<owner>/wolfssl-ci-debs by the ci-deps-image workflow
-      (e.g. "ubuntu-24.04"). When set, the packages are installed offline
+      (e.g. "ubuntu-24.04-minimal"). When set, the packages are installed offline
       from that bundle - the apt mirror is never contacted - and the apt
       cache path below is skipped entirely. Any failure (bundle missing,
       not public, or missing a package) falls through to the apt path, so
@@ -59,9 +59,13 @@ runs:
         docker rm "$cid" >/dev/null 2>&1 || true
         ls "$RUNNER_TEMP"/ghcr-debs/*.deb >/dev/null 2>&1 || { echo "::notice::bundle had no .debs; using apt"; exit 0; }
         sudo cp "$RUNNER_TEMP"/ghcr-debs/*.deb /var/cache/apt/archives/
+        NO_REC=""
+        if [ "${{ inputs.no-install-recommends }}" = "true" ]; then
+          NO_REC="--no-install-recommends"
+        fi
         # --no-download forbids any network fetch: if the bundle is missing
         # a package this fails cleanly (nothing installed) and we fall back.
-        if sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-download ${{ inputs.packages }}; then
+        if sudo DEBIAN_FRONTEND=noninteractive apt-get install -y $NO_REC --no-download ${{ inputs.packages }}; then
           echo "satisfied=true" >> "$GITHUB_OUTPUT"
           echo "Installed offline from $IMG: ${{ inputs.packages }}"
         else
diff --git a/.github/workflows/os-check.yml b/.github/workflows/os-check.yml
index 6da5e7af89..4e038946e3 100644
--- a/.github/workflows/os-check.yml
+++ b/.github/workflows/os-check.yml
@@ -17,10 +17,10 @@ on:
       - '**/*.md'
       - 'doc/**'
   # Weekday-morning cron (10:00 UTC) seeds the master-scoped ccache that PR runs restore: the
-  # linux job re-runs --build-only (compile only, no tests) on the default
-  # branch, where its ccache writes are visible to every PR. macOS and
-  # Windows are skipped on schedule (see their job `if`s) - seeding the
-  # linux shards is where the cold-cache cost lives.
+  # linux and macOS jobs re-run --build-only (compile only, no tests) on the
+  # default branch, where their ccache writes are visible to every PR. Only
+  # Windows is skipped on schedule (see its job `if`) - seeding the linux and
+  # macOS shards is where the cold-cache cost lives.
   schedule:
     - cron: '0 10 * * 1-5'