diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 50bfe13..5386e49 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,9 @@ env:
   NODE_VERSION: "20"
   PNPM_VERSION: "9.14.2"
   CI_AUTH_URL: http://localhost:3100
-  CI_AUTH_SECRET: ${{ secrets.CI_AUTH_SECRET }}
+  # Placeholder for CI — real secret only matters at deploy time.
+  # next build collects page data for auth routes and aborts if empty.
+  CI_AUTH_SECRET: ci-test-secret-minimum-32-chars-xx
 
 jobs:
   guardrails:
@@ -172,6 +174,9 @@ jobs:
     env:
       DATABASE_URL: postgresql://capakraken:capakraken_test@postgres:5432/capakraken_test
       REDIS_URL: redis://redis:6379
+      # Force in-memory rate limiter to avoid cross-test state when Redis drops.
+      # Redis fallback downgrades to max/10 limits which rate-limits unit tests.
+      RATE_LIMIT_BACKEND: memory
       NEXTAUTH_URL: ${{ env.CI_AUTH_URL }}
       AUTH_URL: ${{ env.CI_AUTH_URL }}
       NEXTAUTH_SECRET: ${{ env.CI_AUTH_SECRET }}