diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index 15575f92..6b107095 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -10,8 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
-      MAP_TILE_URL: ${{ secrets.MAP_TILE_URL || '/map/api/tile/{z}/{x}/{y}.jpeg' }}
-      API_BASE_URL: ${{ secrets.API_BASE_URL || '/api' }}
+      # MAP_TILE_URL / API_BASE_URL are intentionally NOT exported at job level —
+      # vitest validates them via Zod and rejects relative paths. Build args are
+      # set inline on the docker_build step instead.
       BASIC_AUTH_USER: ${{ secrets.BASIC_AUTH_USER }}
       BASIC_AUTH_PASS: ${{ secrets.BASIC_AUTH_PASS }}
       TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
@@ -65,6 +66,9 @@ jobs:
 
       - name: Build SSR image
         id: docker_build
+        env:
+          MAP_TILE_URL: ${{ secrets.MAP_TILE_URL || '/map/api/tile/{z}/{x}/{y}.jpeg' }}
+          API_BASE_URL: ${{ secrets.API_BASE_URL || '/api' }}
         run: |
           docker build -f Dockerfile.react \
             --build-arg "MAP_TILE_URL=${MAP_TILE_URL}" \
@@ -106,7 +110,7 @@ jobs:
 
       - name: Upload artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: ci-deploy-failure-${{ github.run_id }}
           path: |
diff --git a/.gitea/workflows/release-verify.yml b/.gitea/workflows/release-verify.yml
index 636a152d..6f35558e 100644
--- a/.gitea/workflows/release-verify.yml
+++ b/.gitea/workflows/release-verify.yml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Upload artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: release-verify-failure-${{ github.run_id }}
           path: |