diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 826b433..4645c90 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -480,22 +480,30 @@ jobs:
           echo "$BODY"
           echo "$BODY" | grep '"status":"ok"'
 
-      - name: Warm up root path (Next.js dev compile)
+      - name: Warm up root and signin paths (Next.js dev compile)
         # Dockerfile.dev runs `pnpm dev`, so Next.js compiles pages on the
         # first request. The middleware+root combo on a cold server can
         # take >10s to JIT-compile and sometimes OOM-kills a worker on the
         # QNAP runner, causing the "unauthenticated root redirects" smoke
-        # test to hit ERR_CONNECTION_REFUSED. Warm the route here so the
-        # smoke run only exercises a ready server.
+        # test to hit ERR_CONNECTION_REFUSED. Warm both routes before the
+        # smoke run: root (must return 307 redirect) and /auth/signin
+        # (must return 200). Do NOT use -L; the Location target can point
+        # to a hostname that is unreachable from the runner namespace, and
+        # we only need the route compiled, not the redirect followed.
         run: |
-          for i in $(seq 1 12); do
-            CODE=$(curl -s -o /dev/null -w "%{http_code}" -L --max-time 30 http://app:3100/ || echo "000")
-            echo "Warm-up $i: HTTP $CODE"
-            # Follow-redirect lands on /auth/signin which returns 200.
-            if [ "$CODE" = "200" ]; then exit 0; fi
-            sleep 5
-          done
-          echo "Warm-up did not reach 200; continuing anyway"
+          warm() {
+            local path="$1"
+            local expect="$2"
+            for i in $(seq 1 24); do
+              CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 "http://app:3100${path}" || echo "000")
+              echo "Warm-up ${path} $i: HTTP $CODE"
+              if [ "$CODE" = "$expect" ]; then return 0; fi
+              sleep 5
+            done
+            echo "Warm-up ${path} did not reach $expect; continuing anyway"
+          }
+          warm / 307
+          warm /auth/signin 200
 
       - name: Seed admin user
         # setup-admin.mjs imports @prisma/client and @node-rs/argon2, both of