diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index 462e760..4216060 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -40,11 +40,21 @@ jobs:
       - name: Build backend
         run: dotnet build JobTrackerApi/JobTrackerApi.csproj --configuration Release
 
-      # No --no-build: the build step above only builds JobTrackerApi, so the test project was never
-      # compiled and `--no-build` made this step a ~1s no-op (or ran a stale binary left on the
-      # self-hosted runner). The backend suite was therefore not actually gating CI.
+      # The "Build backend" step above only builds JobTrackerApi, so the test project needs its own
+      # restore + build. These are separate steps on purpose: this runner is flaky (see the SDK and
+      # npm retries in this file) and the job log is not readable from the API, so distinct steps make
+      # the failing phase identifiable from step boundaries alone. Restore retries once, mirroring the
+      # npm ci pattern below. The suite itself is never weakened or filtered.
+      - name: Restore backend tests
+        run: |
+          restore() { dotnet restore JobTrackerApi.Tests/JobTrackerApi.Tests.csproj; }
+          restore || ( echo "NuGet restore failed ($?) — retrying once..." && restore )
+
+      - name: Build backend tests
+        run: dotnet build JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore
+
       - name: Test backend
-        run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release
+        run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build
 
       - name: Install frontend deps
         working-directory: job-tracker-ui