diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 8b5c25e..80db345 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -18,7 +18,25 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: nrwl/nx-set-shas@v4
+      # Derive NX_BASE / NX_HEAD for `nx affected`. Replaces
+      # nrwl/nx-set-shas@v4, which is GitHub-only (it queries the GitHub
+      # API to find the last successful workflow run, returning 404 on
+      # Gitea). HEAD~1 is a reasonable approximation for push events on
+      # a squash-merge trunk; pull_request uses the merge-base with the
+      # target branch.
+      - name: Derive Nx affected base and head
+        shell: bash
+        run: |
+          # `actions/checkout@v4` with fetch-depth: 0 already pulls every
+          # branch and tag, so origin/<base_ref> is present locally — no
+          # extra `git fetch` is needed (and `--depth=0` is invalid: git
+          # requires a positive integer).
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "NX_BASE=$(git merge-base HEAD origin/${{ github.base_ref }})" >> "$GITHUB_ENV"
+          else
+            echo "NX_BASE=HEAD~1" >> "$GITHUB_ENV"
+          fi
+          echo "NX_HEAD=HEAD" >> "$GITHUB_ENV"
       - uses: pnpm/action-setup@v3
       - uses: actions/setup-node@v4
         with:
@@ -70,6 +88,12 @@ jobs:
 
   perf:
     runs-on: [self-hosted, on-prem]
+    # Lighthouse CI drives a real Chrome instance; the default act runner
+    # image (catthehacker/ubuntu:act-22.04) ships without one. The :full
+    # variant adds Chrome, Firefox, and the GUI-test toolchain — pinned
+    # to the same Ubuntu 22.04 base as the default labels for parity.
+    container:
+      image: catthehacker/ubuntu:full-22.04
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v3
diff --git a/lighthouserc.js b/lighthouserc.js
index 9d44732..d8a2575 100644
--- a/lighthouserc.js
+++ b/lighthouserc.js
@@ -23,6 +23,16 @@ module.exports = {
         // Slow-4G profile so scores are stable across CI runners and
         // comparable to industry public benchmarks.
         preset: 'desktop',
+        // Chrome's user-namespace sandbox is disabled inside the act
+        // runner container (AppArmor restriction on the host kernel),
+        // so Chrome fails to launch with a "No usable sandbox" zygote
+        // error. `--no-sandbox` is the standard Lighthouse / Puppeteer
+        // / Playwright workaround for containerised CI: the residual
+        // risk is acceptable because Chrome only loads our own freshly
+        // built bundle from http://localhost:4200/ inside an ephemeral
+        // self-hosted runner container — no untrusted content reaches
+        // the browser process.
+        chromeFlags: '--no-sandbox',
       },
     },
     assert: {
diff --git a/package.json b/package.json
index 2265fb8..3be8b8f 100644
--- a/package.json
+++ b/package.json
@@ -16,6 +16,22 @@
       "prettier --write"
     ]
   },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@nestjs/core",
+      "@parcel/watcher",
+      "@prisma/client",
+      "@prisma/engines",
+      "@swc/core",
+      "esbuild",
+      "less",
+      "lmdb",
+      "msgpackr-extract",
+      "nx",
+      "prisma",
+      "unrs-resolver"
+    ]
+  },
   "devDependencies": {
     "@analogjs/vite-plugin-angular": "~2.1.2",
     "@analogjs/vitest-angular": "~2.1.2",