diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 78d2c11..7294425 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -144,23 +144,20 @@ jobs:
 
       - name: Create CI user and session
         run: |
-          node -e "
+          pnpm --filter @mcpctl/db exec node -e "
             const { PrismaClient } = require('@prisma/client');
             const crypto = require('crypto');
-            const bcrypt = require('bcrypt');
             (async () => {
               const prisma = new PrismaClient();
-              const hash = await bcrypt.hash('ci-smoke-test', 10);
               const user = await prisma.user.upsert({
                 where: { email: 'ci@test.local' },
-                create: { email: 'ci@test.local', name: 'CI', passwordHash: hash, role: 'USER' },
-                update: { passwordHash: hash },
+                create: { email: 'ci@test.local', name: 'CI', passwordHash: '!ci-no-login', role: 'USER' },
+                update: {},
               });
               const token = crypto.randomBytes(32).toString('hex');
               await prisma.session.create({
                 data: { token, userId: user.id, expiresAt: new Date(Date.now() + 86400000) },
               });
-              // Grant full RBAC permissions
               await prisma.rbacDefinition.create({
                 data: {
                   name: 'ci-admin',