diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index 1be8c7a..2dc0e3c 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -9,6 +9,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
@@ -20,6 +22,15 @@ jobs:
       - name: Setup bun
         run: npm install -g bun
 
+      # The build job must resolve registry @lilith/* deps (gov-detection,
+      # configs) the same way publish does. Without this it installs against the
+      # repo bunfig (npm.black.lan, empty token) and silently under-installs —
+      # the reason every prior `build` run failed even on main.
+      - name: Configure registry
+        run: |
+          echo "@lilith:registry=https://forge.nasty.sh/api/packages/lilith/npm/" > .npmrc
+          echo "//forge.nasty.sh/api/packages/lilith/npm/:_authToken=${NPM_TOKEN}" >> .npmrc
+
       - name: Install dependencies
         run: bun install --no-frozen-lockfile