diff --git a/src/import/CacheFs.lua b/src/import/CacheFs.lua
index 56974cdb..ad1b9018 100644
--- a/src/import/CacheFs.lua
+++ b/src/import/CacheFs.lua
@@ -294,6 +294,9 @@ function CacheFs.read(rel)
     f:close()
     return data
   end
+  -- headless (plain luajit, e.g. the modkit validate/pack driver): there is
+  -- no save directory to read from, so a cache miss is nil, not a crash
+  if not (love and love.filesystem) then return nil end
   return love.filesystem.read(rel)
 end
 
diff --git a/tests/engine/cache_fs_headless_test.lua b/tests/engine/cache_fs_headless_test.lua
new file mode 100644
index 00000000..286599c4
--- /dev/null
+++ b/tests/engine/cache_fs_headless_test.lua
@@ -0,0 +1,20 @@
+-- CacheFs stays headless-safe: plain luajit has no love global, and the
+-- modkit validate/pack driver reaches CacheFs.read through Data:load when
+-- an optional generated module (audio) is missing from the checkout
+-- (issue #850).  With no portable root and no love there is no save
+-- directory to read from, so the read is a nil miss, not a crash.
+package.path = "./?.lua;./?/init.lua;" .. package.path
+
+local T = require("tests.harness")
+local check = T.check
+
+check(_G.love == nil, "suite runs with no love global")
+
+local CacheFs = require("src.import.CacheFs")
+
+check(CacheFs.read("data/generated/audio.lua") == nil,
+  "read is a nil miss headless, not a crash")
+check(CacheFs.readActive("data/generated/audio.lua") == nil,
+  "readActive is a nil miss headless, not a crash")
+
+T.finish()