diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
new file mode 100644
index 0000000..63d231e
--- /dev/null
+++ b/.gitea/workflows/build.yaml
@@ -0,0 +1,62 @@
+name: build
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  checks:
+    # Gitea Actions cannot expand a dynamic `strategy.matrix` sourced from a prior job's
+    # `needs.*.outputs` — it evaluates the matrix before the upstream job runs, so the
+    # expression degrades to a single empty job (go-gitea/gitea#25179). A *static* matrix
+    # expands at parse time, which works today, so the flake's check attrs are enumerated
+    # here. Regenerate the list with:
+    #   nix eval --json '.#githubActions.matrix' --apply 'm: map (x: x.attr) m.include'
+    strategy:
+      fail-fast: false
+      matrix:
+        attr:
+          - 'githubActions.checks.x86_64-linux."kobors-audit"'
+          - 'githubActions.checks.x86_64-linux."kobors-clippy"'
+          - 'githubActions.checks.x86_64-linux."kobors-deny"'
+          - 'githubActions.checks.x86_64-linux."kobors-docs"'
+          - 'githubActions.checks.x86_64-linux."kobors-fmt"'
+          - 'githubActions.checks.x86_64-linux."kobors-llvm-cov"'
+          - 'githubActions.checks.x86_64-linux."kobors-nextest"'
+          - 'githubActions.checks.x86_64-linux."kobors-toml-fmt"'
+    # Nix-enabled Linux runner (label `nix`); Nix is pre-installed, no installer step.
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build check
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          nix build -L '.#${{ matrix.attr }}'
+
+  # Build the deployable artifacts: the server binary (with the web-ui bundle embedded)
+  # and the standalone wasm bundle. Verifies the package builds, not just the checks.
+  package:
+    runs-on: nix
+    strategy:
+      fail-fast: false
+      matrix:
+        attr:
+          - 'kobors'
+          - 'kobors-web-ui'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build package
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          nix build -L '.#${{ matrix.attr }}'
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
deleted file mode 100644
index 6ad8638..0000000
--- a/.github/workflows/build.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-name: build
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  checks-matrix:
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - id: set-matrix
-        name: Generate Nix Matrix
-        run: |
-          set -Eeu
-          matrix="$(nix eval --json '.#githubActions.matrix')"
-          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
-
-  checks-build:
-    needs: checks-matrix
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix: ${{fromJSON(needs.checks-matrix.outputs.matrix)}}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: nix build -L '.#${{ matrix.attr }}'
-
-  codecov:
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: "write"
-      contents: "read"
-
-    steps:
-    - uses: actions/checkout@v4
-    - uses: DeterminateSystems/nix-installer-action@main
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-
-    - name: Run codecov
-      run: nix build .#checks.x86_64-linux.hello-llvm-cov
-
-    - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@v5.5.2
-      with:
-        flags: unittests
-        name: codecov-hello
-        fail_ci_if_error: true
-        token: ${{ secrets.CODECOV_TOKEN }}
-        files: ./result
-        verbose: true
-
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
deleted file mode 100644
index c7048c4..0000000
--- a/.github/workflows/docs.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: docs
-
-on:
-  push:
-    branches: [ master ]
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  docs:
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: "write"
-      contents: "read"
-      pages: "write"
-
-    steps:
-    - uses: actions/checkout@v4
-    - uses: DeterminateSystems/nix-installer-action@main
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    - uses: DeterminateSystems/flake-checker-action@main
-
-    - name: Generate docs
-      run: nix build .#checks.x86_64-linux.hello-docs
-
-    - name: Setup Pages
-      uses: actions/configure-pages@v5
-
-    - name: Upload artifact
-      uses: actions/upload-pages-artifact@v3
-      with:
-        path: result/share/doc
-
-    - name: Deploy to gh-pages
-      id: deployment
-      uses: actions/deploy-pages@v4
-