diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f64ca84..9a97ce6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -463,13 +463,21 @@ jobs:
       - name: Seed admin user
         # setup-admin.mjs imports @prisma/client and @node-rs/argon2, both of
         # which live only in packages/db/node_modules under pnpm workspaces.
-        # Node's bare-specifier resolution walks up from the *script's*
-        # directory (/app/scripts), not cwd, and the root /app/node_modules
-        # has neither. NODE_PATH adds packages/db/node_modules as a fallback
-        # resolution root so the imports succeed.
+        # Node's ESM bare-specifier resolver walks up from the *script's*
+        # directory (/app/scripts), not cwd, and NODE_PATH is a CJS-only
+        # escape hatch (ignored by ESM). Create a scripts/node_modules with
+        # symlinks to the real package directories so the resolver finds
+        # them on the first step up.
         run: |
           docker compose -f docker-compose.yml -f docker-compose.ci.yml exec -T app \
-            sh -c 'NODE_PATH=/app/packages/db/node_modules node /app/scripts/setup-admin.mjs --email admin@capakraken.dev --name Admin --password admin123'
+            sh -c '
+              set -e
+              mkdir -p /app/scripts/node_modules
+              ln -sfn /app/packages/db/node_modules/@prisma   /app/scripts/node_modules/@prisma
+              ln -sfn /app/packages/db/node_modules/@node-rs  /app/scripts/node_modules/@node-rs
+              ln -sfn /app/packages/db/node_modules/.prisma   /app/scripts/node_modules/.prisma
+              node /app/scripts/setup-admin.mjs --email admin@capakraken.dev --name Admin --password admin123
+            '
 
       - name: Set up Node.js 20
         uses: actions/setup-node@v4.0.4