diff --git a/.gitea/workflows/gates.yml b/.gitea/workflows/gates.yml
index f2a0333..28a96d5 100644
--- a/.gitea/workflows/gates.yml
+++ b/.gitea/workflows/gates.yml
@@ -101,15 +101,13 @@ jobs:
           sudo apt-get update -qq
           sudo apt-get install -qq -y --no-install-recommends qemu-user
 
-      # QEMU_ONE_INSN_PER_TB: qemu's TCG with translation-block optimization
-      # (observed on 8.2 and 11.1) takes the panic branch of Zig's UBSan
-      # pointer-overflow check on a valid in-bounds pointer (subs+b.cc is
-      # correct AArch64; real silicon and one-insn-per-tb both pass). The
-      # false abort makes qemu write a ~380 MB guest core per crashing test
-      # and the respawn loop ran the job into the runner's 3 h kill. ~10x
-      # slower, correct by construction.
+      # qemu 11.1.0 has a TCG regression: its translation-block optimization
+      # takes the panic branch of Zig's UBSan pointer-overflow check on a
+      # valid in-bounds pointer (11.0.3 and earlier are clean; bisected via
+      # the Arch archive). This image's qemu 8.2 is not affected — do not
+      # upgrade the emulator past 11.0.x until qemu fixes it.
       - name: Run test suite under qemu (plain suite, no -Dintegration)
-        run: QEMU_ONE_INSN_PER_TB=1 zig build test-aarch64 -fqemu
+        run: zig build test-aarch64 -fqemu
 
   frontend:
     # The light runner, a second act_runner at capacity 1 that advertises only