diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 921f59d..8780166 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,8 +12,26 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Gate the image publish on the same tests CI runs, so a red test never
+  # ships an image.
+  verify:
+    name: Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Server tests
+        working-directory: server
+        run: npm ci && npm test
+      - name: Client build
+        working-directory: client
+        run: npm ci && npm run build
+
   publish:
     name: Build and push to GHCR
+    needs: verify
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/server/test/scheduler.test.js b/server/test/scheduler.test.js
index 7c30146..9fb5cb8 100644
--- a/server/test/scheduler.test.js
+++ b/server/test/scheduler.test.js
@@ -1,6 +1,15 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { msUntilNext } from '../src/scheduler.js';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// scheduler.js transitively imports db.js, which creates config.DATA_DIR at
+// load time — point it at a throwaway dir BEFORE importing (CI can't mkdir /data).
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'dockpull-sched-'));
+process.env.DATA_DIR = tmp;
+
+const { msUntilNext } = await import('../src/scheduler.js');
 
 test('msUntilNext: later today', () => {
   const now = new Date(2026, 0, 1, 8, 0, 0); // 08:00