diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 95d473dfd..467efd5da 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -971,7 +971,12 @@ jobs:
   # -------------------------------------------------------------------------
   libva-v4l2-request-fourier-debian:
     needs: libva-v4l2-request-fourier-aarch64
-    runs-on: arch-aarch64
+    # Native Debian trixie runner — the driver bakes __vaDriverInit_1_<MINOR>
+    # at compile time from <va/va.h>.  Building on Arch (libva 2.23) produced
+    # __vaDriverInit_1_23, which trixie's libva 2.22 runtime cannot bind: the
+    # .deb installed but vaInitialize() returned -1 on every host.  A native
+    # trixie runner avoids the cross-distro ABI skew entirely.
+    runs-on: debian-aarch64-bohr
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -989,9 +994,12 @@ jobs:
         run: |
           set -e
           retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
-          retry pacman -Syu --noconfirm --needed \
-            dpkg openssh rsync curl base-devel git meson ninja pkgconf \
-            libva libdrm systemd-libs
+          export DEBIAN_FRONTEND=noninteractive
+          retry apt-get update -qq
+          retry apt-get install -y --no-install-recommends \
+              build-essential meson ninja-build pkg-config \
+              libva-dev libdrm-dev \
+              curl openssh-client rsync ca-certificates git dpkg-dev
 
       - name: install hertz deploy ssh key
         if: steps.skip-check.outputs.skip != '1'
diff --git a/debian/libva-v4l2-request-fourier/build-deb.sh b/debian/libva-v4l2-request-fourier/build-deb.sh
index 9d15f1d77..49d639a72 100755
--- a/debian/libva-v4l2-request-fourier/build-deb.sh
+++ b/debian/libva-v4l2-request-fourier/build-deb.sh
@@ -16,7 +16,7 @@ set -euo pipefail
 # on 'p' (rpi-hevc-dec).
 UPSTREAM_COMMIT=c332d34643be29e88012e30878d2fbeb255b20ab
 PKGVER=1.0.0+r378+gc332d34
-PKGREL=1
+PKGREL=2  # rebuild against pinned trixie libva-dev (2.22) for __vaDriverInit_1_22 ABI
 
 HERE=$(dirname "$(readlink -f "$0")")
 
@@ -40,6 +40,28 @@ meson setup build \
     -Db_lto=false
 meson compile -C build
 
+# ---------------------------------------------------------------------------
+# ABI sanity check: the produced .so MUST export __vaDriverInit_1_<MINOR>
+# matching the install target's libva runtime.  Build is expected to run on
+# a Debian trixie runner where <va/va.h>'s VA_MINOR is 22 — see
+# .gitea/workflows/build.yml (runs-on: debian-aarch64-bohr).  If a future
+# runner change lands the build on a host with a different libva-dev
+# version, the produced symbol won't bind on the install target and ffmpeg/
+# vainfo/firefox-vaapi will all fail with "has no function
+# __vaDriverInit_1_0".  Fail loud at build time instead of shipping a
+# silently-broken .deb (which is what happened in -1).
+# ---------------------------------------------------------------------------
+SO=$(find build -name 'v4l2_request_drv_video.so' | head -1)
+if ! nm -D --defined-only "$SO" | grep -q '__vaDriverInit_1_22'; then
+    echo "FATAL: built driver does not export __vaDriverInit_1_22."
+    echo "    Build host's <va/va.h> VA_MINOR_VERSION is likely != 22."
+    echo "    Expected runner: debian-aarch64-bohr (trixie, libva 2.22)."
+    echo "    Symbol exports found:"
+    nm -D --defined-only "$SO" | grep -i vadriverinit || echo "    (none)"
+    exit 1
+fi
+echo "ABI check: $SO exports __vaDriverInit_1_22 (matches trixie libva 2.22)"
+
 ROOT="$work/pkgroot"
 DESTDIR="$ROOT" meson install -C build
 
diff --git a/debian/libva-v4l2-request-fourier/debian/changelog b/debian/libva-v4l2-request-fourier/debian/changelog
index a22e9236b..ec93fb50c 100644
--- a/debian/libva-v4l2-request-fourier/debian/changelog
+++ b/debian/libva-v4l2-request-fourier/debian/changelog
@@ -1,3 +1,22 @@
+libva-v4l2-request-fourier (1.0.0+r378+gc332d34-2) bookworm trixie; urgency=medium
+
+  * Rebuild on a native Debian trixie runner (debian-aarch64-bohr) so
+    the driver picks up trixie's libva-dev (2.22) and exports
+    __vaDriverInit_1_22 — the symbol trixie's libva runtime looks up.
+    Previous -1 build used the Arch CI runner (libva 2.23.0) and
+    exported __vaDriverInit_1_23, which trixie's loader cannot bind:
+    vaInitialize() returns -1 ("has no function __vaDriverInit_1_0")
+    and ffmpeg -hwaccel vaapi fails on startup.
+  * No source change; pure build-env fix.  CI workflow's
+    libva-v4l2-request-fourier-debian job moved from runs-on:
+    arch-aarch64 to runs-on: debian-aarch64-bohr; build-deps installed
+    via apt-get instead of pacman.
+  * Hard sanity check kept in build-deb.sh: build fails if the
+    resulting .so doesn't export __vaDriverInit_1_22 (preempts the
+    silent install-then-refuse-to-load failure mode).
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 18:00:00 +0000
+
 libva-v4l2-request-fourier (1.0.0+r378+gc332d34-1) bookworm trixie; urgency=medium
 
   * Bump to c332d34 — LIBVA-1 per-codec dispatch close.  Pi 5 mixed