diff --git a/.github/workflows/R-CMD-check.yml b/.github/workflows/R-CMD-check.yml
index 31eaf2107..5cbba4b7f 100644
--- a/.github/workflows/R-CMD-check.yml
+++ b/.github/workflows/R-CMD-check.yml
@@ -237,6 +237,21 @@ jobs:
           needs: |
             check
             coverage
+          # MaxMin url:: -- this is the Windows leg, so it cannot use the Linux
+          # tarball the `runner.os != 'Windows'` step below selects. Without a
+          # url:: reference the solve fails outright ("Can't find package called
+          # MaxMin"): pak does not read `Additional_repositories`, so the drat's
+          # indexed contrib/ layout is invisible to it. See ms609/packages'
+          # tools/publish-maxmin.R, which publishes this flat alias for exactly
+          # this purpose.
+          extra-packages: |
+            url::https://ms609.github.io/packages/bin/windows/MaxMin_latest.zip
+          # install-pandoc must stay explicit -- see the long note in
+          # agent-check.yml's windows leg. Auto-detect runs a second, fresh
+          # `pak::pkg_deps(".")` solve that cannot see extra-packages, so it
+          # fails on MaxMin by name; the branch only fires when pandoc is off
+          # PATH, which is why only the non-Linux legs hit it.
+          install-pandoc: true
           # cache-version bumped to 2: the v1 caches were built while a
           # project-level .Rprofile shadowed ~/.Rprofile, so every package
           # in them was compiled from source.  Retire them once.
@@ -327,8 +342,18 @@ jobs:
         with:
           needs: |
             check
+          # MaxMin url:: -- same reason as the core Windows leg. Added
+          # pre-emptively: this job was skipped in the run that diagnosed the
+          # failure (it is gated on `detect app changes`), so unlike the core leg
+          # it is not yet observed failing -- but it resolves the same
+          # `needs: check` Suggests on the same platform, so it would.
           extra-packages: |
             local::.
+            url::https://ms609.github.io/packages/bin/windows/MaxMin_latest.zip
+          # install-pandoc explicit for the same reason as the core Windows leg
+          # (auto-detect's `pak::pkg_deps(".")` solve cannot see extra-packages).
+          # `false` here: this job runs shinytest2, not vignettes.
+          install-pandoc: false
           # cache-version bumped to 2: the v1 caches were built while a
           # project-level .Rprofile shadowed ~/.Rprofile, so every package
           # in them was compiled from source.  Retire them once.
@@ -410,6 +435,19 @@ jobs:
         with:
           needs: |
             check
+          # MaxMin url:: -- same mechanism as the Windows and Linux legs, picked
+          # per architecture (macOS-latest is arm64; macos-15-intel is x86_64).
+          # Added pre-emptively and NOT yet observed failing: this job is
+          # `needs: core`, so it was skipped while the Windows leg was red.
+          # Fixing that leg unskips this one, which would then hit the identical
+          # unresolvable-Suggests error -- note `_R_CHECK_FORCE_SUGGESTS_: false`
+          # does not help, since it governs R CMD check, not pak's solve.
+          extra-packages: |
+            ${{ matrix.config.os == 'macos-15-intel' && 'url::https://ms609.github.io/packages/bin/macosx/big-sur-x86_64/MaxMin_latest.tgz' || 'url::https://ms609.github.io/packages/bin/macosx/big-sur-arm64/MaxMin_latest.tgz' }}
+          # install-pandoc explicit for the same reason as the Windows legs; also
+          # pre-emptive, since whether a macOS runner ships pandoc on PATH is
+          # exactly the condition that decides whether the bad branch fires.
+          install-pandoc: true
           # cache-version bumped to 2: the v1 caches were built while a
           # project-level .Rprofile shadowed ~/.Rprofile, so every package
           # in them was compiled from source.  Retire them once.
diff --git a/.github/workflows/agent-check.yml b/.github/workflows/agent-check.yml
index 14d13374b..1f8319baa 100644
--- a/.github/workflows/agent-check.yml
+++ b/.github/workflows/agent-check.yml
@@ -115,6 +115,28 @@ jobs:
         uses: r-lib/actions/setup-r-dependencies@v2
         with:
           needs: check
+          # MaxMin url:: -- the Windows counterpart of the arm64 leg's line, and
+          # the reason this leg used to fail before compiling anything. MaxMin is
+          # not on CRAN, and pak does NOT read `Additional_repositories` from
+          # DESCRIPTION (confirmed empirically 2026-08-03, recorded in
+          # ms609/packages' tools/publish-maxmin.R), so the indexed drat layout
+          # alone leaves it unresolvable and the solve dies with "Can't find
+          # package called MaxMin". Naming the flat, unversioned alias directly
+          # is the mechanism that publish script exists to provide; it always
+          # points at the current build, so it needs no edit when MaxMin moves.
+          extra-packages: |
+            url::https://ms609.github.io/packages/bin/windows/MaxMin_latest.zip
+          # install-pandoc MUST stay explicit here, and the url:: above is not
+          # sufficient without it. Left unset, setup-r-dependencies auto-detects
+          # by running `pak::pkg_deps(".", dependencies = list(direct = "all"))`
+          # -- a SECOND, fresh solve that sees neither the lockfile nor
+          # extra-packages, so it looks MaxMin up by name and dies with
+          # "* local::.: Can't install dependency MaxMin" even though MaxMin has
+          # just been installed successfully. That branch only runs when pandoc
+          # is absent from PATH, which is exactly why the Linux legs never hit it
+          # (their runners ship pandoc) and this one did. `true` rather than
+          # `false` because this leg checks with vignettes.
+          install-pandoc: true
           # cache-version bumped to 2: the v1 caches were built while a
           # project-level .Rprofile shadowed ~/.Rprofile, so every package
           # in them was compiled from source.  Retire them once.