diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 664d7ad..5af2052 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -72,11 +72,17 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm lint
       - run: pnpm typecheck
-      - run: pnpm test --coverage
+      # `pnpm test` already includes --coverage via the package.json script.
+      - run: pnpm test
       - name: coverage gate
         run: |
           node -e "const c=require('./coverage/coverage-summary.json').total.lines.pct; if (c<70) { console.error('coverage', c, '< 70%'); process.exit(1) }"
-      - run: pnpm build
+      - name: build
+        env:
+          # Required at build-time by Auth.js. Replaced by Infisical-sourced
+          # secret in stage/prod via Orca env injection (M5.1+).
+          AUTH_SECRET: ci-build-dummy-${{ github.sha }}
+        run: pnpm build
 
   e2e:
     needs: test