diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 8021207..1cb5e7d 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -65,6 +65,10 @@ jobs:
         working-directory: frontend
     steps:
       - uses: actions/checkout@v4
-      - run: npm ci --no-audit --no-fund
+      # No package-lock.json is tracked yet (we don't run npm locally per
+      # feedback-no-local-runs). Using `npm install` instead of `npm ci`.
+      # If we want strict lockfile-based reproducibility later, commit a
+      # package-lock.json and flip this back to `npm ci`.
+      - run: npm install --no-audit --no-fund
       - run: npm run check
       - run: npm run build