diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0c32137..a5b5242 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -303,6 +303,9 @@ jobs:
           --health-retries=5
     env:
       DATABASE_URL: postgresql://capakraken:capakraken_test@postgres:5432/capakraken_test
+      # prisma-with-env.mjs refuses to run unless DATABASE_URL's db name matches
+      # the expected target; default is "capakraken", CI uses capakraken_test.
+      CAPAKRAKEN_EXPECTED_DB_NAME: capakraken_test
       ALLOW_DESTRUCTIVE_DB_TOOLS: "true"
       CONFIRM_DESTRUCTIVE_DB_NAME: capakraken_test
       REDIS_URL: redis://redis:6379
@@ -382,17 +385,17 @@ jobs:
           EOF
 
       - name: Start infrastructure (postgres + redis)
-        run: docker compose up -d postgres redis
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d postgres redis
 
       - name: Wait for postgres
         run: |
           for i in $(seq 1 20); do
-            docker compose exec -T postgres pg_isready -U capakraken -d capakraken && break
+            docker compose -f docker-compose.yml -f docker-compose.ci.yml exec -T postgres pg_isready -U capakraken -d capakraken && break
             sleep 3
           done
 
       - name: Build and start app (full profile)
-        run: docker compose --profile full up -d --build app
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml --profile full up -d --build app
 
       - name: Wait for /api/health (up to 3 minutes)
         run: |
@@ -403,7 +406,7 @@ jobs:
             sleep 5
           done
           echo "Health check timed out"
-          docker compose logs app --tail=50
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml logs app --tail=50
           exit 1
 
       - name: Verify health response contains status ok
@@ -414,7 +417,7 @@ jobs:
 
       - name: Seed admin user
         run: |
-          docker compose exec -T app node /app/scripts/setup-admin.mjs \
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml exec -T app node /app/scripts/setup-admin.mjs \
             --email admin@capakraken.dev \
             --name "Admin" \
             --password admin123
@@ -443,7 +446,7 @@ jobs:
 
       - name: Show logs on failure
         if: failure()
-        run: docker compose logs --tail=100
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml logs --tail=100
 
   # ──────────────────────────────────────────────
   # Release images — only on push to main, after
diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml
new file mode 100644
index 0000000..14c18f2
--- /dev/null
+++ b/docker-compose.ci.yml
@@ -0,0 +1,15 @@
+# CI override for docker-deploy-test.
+#
+# The dev compose bind-mounts `.:/app` so edits are live during `pnpm dev`.
+# Under act_runner (docker-outside-of-docker on Gitea), the host docker
+# daemon cannot see the job container's /workspace/... path, so the bind
+# mount resolves to an empty directory inside the app container and masks
+# everything the Dockerfile copied in — including tooling/docker/app-dev-start.sh.
+#
+# Result: `sh: cannot open ./tooling/docker/app-dev-start.sh: No such file`.
+#
+# This override strips all bind mounts from the `app` service so the image
+# runs against its baked-in copy of the repo.
+services:
+  app:
+    volumes: !reset []