diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4862a8a..40baf62 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,6 +1,11 @@
 # Runs on every push and pull request (no branch filter) so feature branches,
 # their pull requests, and dev/main are all checked. Runs directly on the
 # self-hosted act_runner; no container: key.
+#
+# The Makefile is the single build definition: CI runs `make test` and
+# `make build` so it fails whenever either target would, and the binary
+# carries the Makefile's -trimpath and version-stamped -ldflags (the
+# `make build` log shows the -X main.version=... value).
 name: CI
 
 on: [push, pull_request]
@@ -16,45 +21,12 @@ jobs:
           go-version-file: go.mod
           cache: false
 
-      - name: gofmt
-        run: |
-          unformatted="$(gofmt -l .)"
-          if [ -n "$unformatted" ]; then
-            echo "gofmt needed:"
-            echo "$unformatted"
-            exit 1
-          fi
-
-      - name: go vet
-        run: go vet ./...
-
-      - name: go test
-        run: go test -race ./...
-
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
 
-      - name: npm ci
-        working-directory: web
-        run: npm ci
+      - name: make test
+        run: make test
 
-      - name: npm run typecheck
-        working-directory: web
-        run: npm run typecheck
-
-      - name: npm test
-        working-directory: web
-        run: npm test
-
-      - name: npm run build
-        working-directory: web
-        run: npm run build
-
-      # Embed the real PWA, as `make embed` does, then build the static binary.
-      - name: go build (embedded PWA)
-        run: |
-          rm -rf internal/frontend/dist
-          mkdir -p internal/frontend/dist
-          cp -R web/dist/. internal/frontend/dist/
-          CGO_ENABLED=0 go build -o bin/mealquest ./cmd/server
+      - name: make build
+        run: make build