diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index bb20dff..676e44a 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -14,8 +14,11 @@ jobs:
     # app is force-dynamic, so `next build` never touches Postgres. These
     # are dummy values only so a real config error (a missing secret) is
     # never silently masked by CI happening to run without one.
+    #
+    # NODE_ENV is deliberately NOT set here: `npm ci` treats a production
+    # NODE_ENV as `--omit=dev`, which would skip eslint/typescript/etc. and
+    # break Lint/Typecheck/Test. It's set below, scoped to the Build step.
     env:
-      NODE_ENV: production
       NEXT_TELEMETRY_DISABLED: "1"
       DATABASE_URI: postgresql://ci:ci@localhost:5432/ci
       PAYLOAD_SECRET: ci-only-not-a-real-secret
@@ -42,4 +45,6 @@ jobs:
         run: npm test
 
       - name: Build
+        env:
+          NODE_ENV: production
         run: npm run build
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 5b6cd63..d4089e2 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -10,8 +10,11 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: node:22-alpine
+    # NODE_ENV is deliberately NOT set at job level: `npm ci` treats a
+    # production NODE_ENV as `--omit=dev`, which would skip eslint/
+    # typescript/etc. and break Lint/Typecheck/Test. It's scoped to the
+    # Build step below instead.
     env:
-      NODE_ENV: production
       NEXT_TELEMETRY_DISABLED: "1"
       DATABASE_URI: postgresql://ci:ci@localhost:5432/ci
       PAYLOAD_SECRET: ci-only-not-a-real-secret
@@ -26,6 +29,8 @@ jobs:
       - run: npx tsc --noEmit
       - run: npm test
       - run: npm run build
+        env:
+          NODE_ENV: production
 
   build-and-deploy:
     needs: test