diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 22d6af8..7d2dead 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -48,6 +48,14 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      - name: Install Docker CLI
+        run: |
+          # Job runs in node:*-bookworm; CLI is missing even when the host
+          # docker.sock is mounted into the container by act_runner.
+          apt-get update
+          apt-get install -y --no-install-recommends docker.io
+          docker version
+
       - name: Build image metadata
         id: image
         run: |
@@ -71,7 +79,11 @@ jobs:
 
       - name: Build Docker image
         run: |
+          # Dockerfile mounts an optional CA secret for npm; provide an empty
+          # file so BuildKit does not fail when no corporate CA is needed.
+          : > /tmp/empty-ca
           docker build \
+            --secret id=ca-cert,src=/tmp/empty-ca \
             --tag "${{ steps.image.outputs.sha_tag }}" \
             --tag "${{ steps.image.outputs.latest_tag }}" \
             .