diff --git a/.gitignore b/.gitignore
index ba170da14..3519bdca5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,6 +16,11 @@ sbom-docker.json
 *.key
 *.tsbuildinfo
 compose/keycloak/probo-realm.json
+compose/step-ca/config/
+compose/step-ca/db/
+compose/step-ca/secrets/
+compose/step-ca/certs/
+compose/step-ca/templates/
 .sandbox.env
 
 # Generated files (codegen)
diff --git a/GNUmakefile b/GNUmakefile
index abad75e5f..d7cbf458d 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -354,11 +354,11 @@ pkg/server/api/connect/v1/types/types.go: pkg/server/api/connect/v1/gqlgen.yaml
 # gqlgen instances must run sequentially: parallel runs race on the Go build
 # cache and cause gqlgen's Rewriter.getSource() to panic with empty source.
 pkg/server/api/console/v1/schema/schema.go \
-pkg/server/api/console/v1/types/types.go: pkg/server/api/console/v1/gqlgen.yaml pkg/server/api/console/v1/graphql $(CONSOLE_GQL) | pkg/server/api/connect/v1/types/types.go
+pkg/server/api/console/v1/types/types.go: pkg/server/api/console/v1/gqlgen.yaml pkg/server/api/console/v1/graphql $(CONSOLE_GQL) | pkg/server/api/connect/v1/types/types.go apps/console/dist/index.html
 	$(GO_GENERATE) ./pkg/server/api/console/v1
 
 pkg/server/api/complianceportal/v1/schema/schema.go \
-pkg/server/api/complianceportal/v1/types/types.go: pkg/server/api/complianceportal/v1/gqlgen.yaml pkg/server/api/complianceportal/v1/graphql $(COMPLIANCEPORTAL_GQL) | pkg/server/api/console/v1/types/types.go
+pkg/server/api/complianceportal/v1/types/types.go: pkg/server/api/complianceportal/v1/gqlgen.yaml pkg/server/api/complianceportal/v1/graphql $(COMPLIANCEPORTAL_GQL) | pkg/server/api/console/v1/types/types.go apps/compliance-portal/dist/index.html
 	$(GO_GENERATE) ./pkg/server/api/complianceportal/v1
 
 pkg/server/api/mcp/v1/server/server.go \
@@ -424,14 +424,17 @@ psql: ## Open a psql shell to the postgres container
 	$(DOCKER_COMPOSE) exec postgres psql -U probod -d probod
 
 compose/step-ca/certs/root_ca.crt:
-	@$(MKDIR) compose/step-ca/secrets
+	# step-ca runs as UID 1000 and must be able to write into the bind mount
+	# on Linux CI (Docker Desktop often masks this locally).
+	@$(MKDIR) compose/step-ca
+	@chmod a+rwx compose/step-ca
 	$(DOCKER_COMPOSE) up -d acme-http-01-proxy step-ca
 	@i=0; \
 	while [ ! -f $@ ] && [ $$i -lt 60 ]; do \
 		sleep 1; \
 		i=$$((i + 1)); \
 	done
-	@test -f $@ || (echo "step-ca root CA not ready; check: docker compose logs step-ca" >&2; exit 1)
+	@test -f $@ || ($(DOCKER_COMPOSE) logs step-ca >&2; echo "step-ca root CA not ready" >&2; exit 1)
 
 compose/keycloak/certs/cert.pem:
 	$(MKDIR) ./compose/keycloak/certs
diff --git a/apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageDomainsSection.tsx b/apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageDomainsSection.tsx
index 44b9973de..7efd9711a 100644
--- a/apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageDomainsSection.tsx
+++ b/apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageDomainsSection.tsx
@@ -67,20 +67,20 @@ export function CompliancePageDomainsSection(props: {
 
         {customDomain
           ? (
-              <CompliancePageDomainCard fKey={customDomain} />
-            )
+            <CompliancePageDomainCard fKey={customDomain} />
+          )
           : organization.canCreateCustomDomain && (
-              <div className="flex flex-col items-center justify-center gap-3 rounded-lg border border-dashed border-border-solid px-4 py-8">
-                <p className="max-w-md text-center text-sm text-txt-tertiary">
-                  {__(
-                    "Use your own domain to make your compliance page feel more professional.",
-                  )}
-                </p>
-                <NewCompliancePageDomainDialog compliancePageId={compliancePageId}>
-                  <Button iconAfter={IconChevronRight}>{__("Configure")}</Button>
-                </NewCompliancePageDomainDialog>
-              </div>
-            )}
+            <div className="flex flex-col items-center justify-center gap-3 rounded-lg border border-dashed border-border-solid px-4 py-8">
+              <p className="max-w-md text-center text-sm text-txt-tertiary">
+                {__(
+                  "Use your own domain to make your compliance page feel more professional.",
+                )}
+              </p>
+              <NewCompliancePageDomainDialog compliancePageId={compliancePageId}>
+                <Button iconAfter={IconChevronRight}>{__("Configure")}</Button>
+              </NewCompliancePageDomainDialog>
+            </div>
+          )}
       </div>
     </section>
   );
diff --git a/compose.github-action.yaml b/compose.github-action.yaml
index 15f60aa5f..4b83b75ab 100644
--- a/compose.github-action.yaml
+++ b/compose.github-action.yaml
@@ -28,3 +28,9 @@ services:
 
   chrome:
     image: "artifact.probo.inc/dockerhub/chromedp/headless-shell@sha256:b24482ae166e2c67135f5a8ba9575c257efdd8e2fd6b2e931f9d88ede3d72f3b"
+
+  acme-http-01-proxy:
+    image: "artifact.probo.inc/dockerhub/library/caddy@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb"
+
+  step-ca:
+    image: "artifact.probo.inc/dockerhub/smallstep/step-ca@sha256:0f88382ac5af5c6b7bbba0c6e8fcefef52aee6f22ea364df8e02a09ffd0d22f3"