diff --git a/.github/workflows/android-release.yml b/.github/workflows/android-release.yml
index be9002f..d33bb78 100644
--- a/.github/workflows/android-release.yml
+++ b/.github/workflows/android-release.yml
@@ -76,6 +76,14 @@ jobs:
           LOTO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: ./gradlew :app:bundleRelease :app:assembleRelease
 
+      # L10: the decoded keystore has no real exposure on this ephemeral
+      # runner (nothing archives the workspace), but removing it explicitly
+      # closes the class of mistake where a future step does. if: always()
+      # so it runs even if the build step above fails.
+      - name: Remove decoded keystore
+        if: always()
+        run: rm -f "$GITHUB_WORKSPACE/keystore.p12"
+
       - name: Upload to GitHub Release
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 48b3e7a..b34c055 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,6 +46,10 @@ jobs:
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-web
+      - run: npm run lint
+        working-directory: web
+      - run: npm run check
+        working-directory: web
       - run: npm test
         working-directory: web
 
@@ -60,10 +64,12 @@ jobs:
           - profile: root
             script: build
             artifact: web-build
+            buildProfile: ''
           # GitHub Pages serves under /loto.
           - profile: gh
             script: 'build:gh'
             artifact: web-build-gh
+            buildProfile: gh
     name: build (${{ matrix.profile }})
     steps:
       - uses: actions/checkout@v7
@@ -72,6 +78,12 @@ jobs:
       - uses: ./.github/actions/setup-web
       - run: npm run ${{ matrix.script }}
         working-directory: web
+      # Fails the build if the SW registration wiring or the audio precache
+      # base-path prefixing regresses — see scripts/verify-pwa-build.mjs.
+      - run: npm run verify:pwa
+        working-directory: web
+        env:
+          BUILD_PROFILE: ${{ matrix.buildProfile }}
       - uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact }}