diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3b21f30..1403d11 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,32 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: dind-builder
+    # Clean Ubuntu with Node tooling; proven on this runner (matches go-monorepo CI).
+    # A job container is required so the `services:` Postgres is reachable by its
+    # service name (`postgres`) on the shared job network.
+    container:
+      image: catthehacker/ubuntu:act-latest
+
+    # pgvector Postgres for the DB-backed *.spec.ts integration suites. The specs
+    # read DATABASE_URL (set below) and fall back to localhost:5434 for local
+    # `docker compose` dev; in CI they connect to this service at postgres:5432.
+    services:
+      postgres:
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_USER: iios
+          POSTGRES_PASSWORD: iios
+          POSTGRES_DB: iios
+        options: >-
+          --health-cmd "pg_isready -U iios"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+
+    env:
+      DATABASE_URL: postgresql://iios:iios@postgres:5432/iios?schema=public
+
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -28,4 +53,7 @@ jobs:
       # TS2307 "Cannot find module '@insignia/iios-contracts'".
       - run: pnpm -r build
       - run: pnpm -r typecheck
+      # Apply the schema to the CI Postgres before the DB-backed specs run
+      # (reset-db.ts TRUNCATEs existing tables; migrations must exist first).
+      - run: pnpm --filter @insignia/iios-service exec prisma migrate deploy
       - run: pnpm test