diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9544b2d5..b295f781 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -148,7 +148,8 @@ jobs:
   # leaves Cargo.lock alone rebuilds only the workspace crates it changed.
   #
   # The repo-stats pipeline runs here because it needs this job's binary:
-  # `nix shell .#improvise` reuses the build above instead of a second one.
+  # `.#repo-stats-tools` is that build plus code-maat and its JRE, which stay
+  # out of the ci shell every other job enters.
   # Its suite gates; the report on a push to main never fails the build, and
   # its step fails only when improvise refuses the pipeline's input
   # (context/code/tooling.md section 7). Full history is for the report.
@@ -162,13 +163,13 @@ jobs:
       - name: nix build .#improvise
         run: nix build --print-build-logs .#improvise
       - name: The repo-stats pipeline computes what it claims to
-        run: nix shell .#improvise --command ./scripts/checkers.sh --ci nix-build
+        run: nix shell .#repo-stats-tools --command ./scripts/checkers.sh --ci nix-build
       - name: Churn, coupling and doc-growth report (report only)
         if: github.event_name == 'push'
         continue-on-error: true
         run: |
           rc=0
-          nix shell .#improvise --command ./scripts/repo-stats --out repo-stats > repo-stats.txt || rc=$?
+          nix shell .#repo-stats-tools --command ./scripts/repo-stats --out repo-stats > repo-stats.txt || rc=$?
           { echo '```'; cat repo-stats.txt; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
           exit "$rc"
       - name: Upload the repo-stats model and its CSVs
diff --git a/flake.nix b/flake.nix
index 2a34a733..46250d37 100644
--- a/flake.nix
+++ b/flake.nix
@@ -83,13 +83,11 @@
         pkgs.nodejs_24
         pkgs.python3
         pkgs.jq
-
-        # scripts/repo-stats runs code-maat for coupling, age, abs-churn and
-        # soc (improvise-1xfb.5.1); the jar is pinned here, not downloaded.
-        pkgs.jre_headless
-        codeMaat
       ];
 
+      # scripts/repo-stats runs code-maat (improvise-1xfb.5.1). The JRE is about
+      # 0.6 GB, so it is kept out of ciInputs; only `nix-build` takes it.
+
       codeMaatJar = pkgs.fetchurl {
         url = "https://github.com/adamtornhill/code-maat/releases/download/v1.0.4/code-maat-1.0.4-standalone.jar";
         hash = "sha256-QoeuIDSQGERFD3aVR7xEl6DaGm0cf6b63IWHBeZ0O18=";
@@ -127,6 +125,7 @@
           pkgs.global
           pkgs.universal-ctags
           beads.packages.${system}.default
+          codeMaat
 
           # Demo recording and release tooling
           pkgs.asciinema
@@ -142,6 +141,13 @@
         // {
           improvise = cargoNix.workspaceMembers.improvise.build;
           default = self.packages.${system}.improvise;
+          code-maat = codeMaat;
+          # What the repo-stats pipeline runs besides the ci shell: one
+          # installable, because check-ci-graph reads `nix shell <one> --command`.
+          repo-stats-tools = pkgs.symlinkJoin {
+            name = "repo-stats-tools";
+            paths = [self.packages.${system}.improvise codeMaat];
+          };
         };
 
       # `nix flake check` builds every CI build: crane's checks plus the
diff --git a/scripts/checkers.sh b/scripts/checkers.sh
index a649100a..8409e639 100755
--- a/scripts/checkers.sh
+++ b/scripts/checkers.sh
@@ -101,7 +101,7 @@ ci_suites() {
   case "$1" in
     build) echo assemble-stamp ;;
     js) echo node-test ;;
-    # Needs the improvise binary, which only this job builds (tooling.md section 7).
+    # Needs improvise and code-maat, which only this job has (tooling.md section 7).
     nix-build) echo repo-stats ;;
     # check-harness-lock must never read "could not resolve" as "stale" (improvise-zs2r).
     kb) echo kb checkers pr-watch release-preflight pr-reviews fmt-workspaces bd-audit-ids check-harness-lock agent-git ;;