diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8943042..14517f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -477,6 +477,23 @@ jobs:
           echo "$BODY"
           echo "$BODY" | grep '"status":"ok"'
 
+      - name: Warm up root path (Next.js dev compile)
+        # Dockerfile.dev runs `pnpm dev`, so Next.js compiles pages on the
+        # first request. The middleware+root combo on a cold server can
+        # take >10s to JIT-compile and sometimes OOM-kills a worker on the
+        # QNAP runner, causing the "unauthenticated root redirects" smoke
+        # test to hit ERR_CONNECTION_REFUSED. Warm the route here so the
+        # smoke run only exercises a ready server.
+        run: |
+          for i in $(seq 1 12); do
+            CODE=$(curl -s -o /dev/null -w "%{http_code}" -L --max-time 30 http://app:3100/ || echo "000")
+            echo "Warm-up $i: HTTP $CODE"
+            # Follow-redirect lands on /auth/signin which returns 200.
+            if [ "$CODE" = "200" ]; then exit 0; fi
+            sleep 5
+          done
+          echo "Warm-up did not reach 200; continuing anyway"
+
       - name: Seed admin user
         # setup-admin.mjs imports @prisma/client and @node-rs/argon2, both of
         # which live only in packages/db/node_modules under pnpm workspaces.