diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml
index 16bde0294..487e7a3cf 100644
--- a/.github/workflows/make.yaml
+++ b/.github/workflows/make.yaml
@@ -80,9 +80,9 @@ jobs:
       - name: "Generate Go code"
         run: |
           go generate ./pkg/server/api/connect/v1
+          go generate ./pkg/server/api/mcp/v1
           go generate ./pkg/server/api/console/v1
           go generate ./pkg/server/api/complianceportal/v1
-          go generate ./pkg/server/api/mcp/v1
       - name: "Build binaries"
         env:
           CGO_ENABLED: "0"
@@ -253,9 +253,9 @@ jobs:
       - name: "Generate Go code"
         run: |
           go generate ./pkg/server/api/connect/v1
+          go generate ./pkg/server/api/mcp/v1
           go generate ./pkg/server/api/console/v1
           go generate ./pkg/server/api/complianceportal/v1
-          go generate ./pkg/server/api/mcp/v1
       - name: "Build probod group binaries"
         env:
           CGO_ENABLED: "0"
@@ -318,9 +318,9 @@ jobs:
       - name: "Generate Go code"
         run: |
           go generate ./pkg/server/api/connect/v1
+          go generate ./pkg/server/api/mcp/v1
           go generate ./pkg/server/api/console/v1
           go generate ./pkg/server/api/complianceportal/v1
-          go generate ./pkg/server/api/mcp/v1
       - name: "Run gofmt"
         run: |
           output="$(gofmt -l apps cmd packages pkg e2e)"
@@ -454,12 +454,10 @@ jobs:
           docker compose pull
           mkdir -p /tmp/docker-images
           docker save $(docker compose config --images) -o /tmp/docker-images/images.tar
-      - name: "Build and start stack in parallel"
-        run: |
-          make stack-up &
-          STACK_PID=$!
-          make bin/probod
-          wait $STACK_PID
+      - name: "Build probod"
+        run: "make bin/probod"
+      - name: "Start stack"
+        run: "make stack-up"
       - run: "make stack-ps"
       - name: "Run e2e tests"
         env:
diff --git a/.github/workflows/release-probod.yaml b/.github/workflows/release-probod.yaml
index a59701d40..0602ff560 100644
--- a/.github/workflows/release-probod.yaml
+++ b/.github/workflows/release-probod.yaml
@@ -74,9 +74,9 @@ jobs:
       - name: "Generate Go code"
         run: |
           go generate ./pkg/server/api/connect/v1
+          go generate ./pkg/server/api/mcp/v1
           go generate ./pkg/server/api/console/v1
           go generate ./pkg/server/api/complianceportal/v1
-          go generate ./pkg/server/api/mcp/v1
       - name: "Build binaries"
         env:
           CGO_ENABLED: "0"
diff --git a/GNUmakefile b/GNUmakefile
index d7cbf458d..469a52058 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -138,7 +138,7 @@ go-lint: generate
 	$(GOLINTCMD) run ./...
 
 .PHONY: test
-test: generate
+test: generate apps/trust/dist/index.html
 test: CGO_ENABLED=1
 test: ## Run tests with race detection and coverage (usage: make test [MODULE=./pkg/some/module])
 	$(GO_TEST) $(if $(MODULE),$(MODULE),$(shell $(GO) list ./... | grep -v /e2e/))
@@ -358,7 +358,7 @@ pkg/server/api/console/v1/types/types.go: pkg/server/api/console/v1/gqlgen.yaml
 	$(GO_GENERATE) ./pkg/server/api/console/v1
 
 pkg/server/api/complianceportal/v1/schema/schema.go \
-pkg/server/api/complianceportal/v1/types/types.go: pkg/server/api/complianceportal/v1/gqlgen.yaml pkg/server/api/complianceportal/v1/graphql $(COMPLIANCEPORTAL_GQL) | pkg/server/api/console/v1/types/types.go apps/compliance-portal/dist/index.html
+pkg/server/api/complianceportal/v1/types/types.go: pkg/server/api/complianceportal/v1/gqlgen.yaml pkg/server/api/complianceportal/v1/graphql $(COMPLIANCEPORTAL_GQL) | pkg/server/api/console/v1/types/types.go pkg/server/api/mcp/v1/types/types.go apps/compliance-portal/dist/index.html
 	$(GO_GENERATE) ./pkg/server/api/complianceportal/v1
 
 pkg/server/api/mcp/v1/server/server.go \
@@ -424,8 +424,8 @@ psql: ## Open a psql shell to the postgres container
 	$(DOCKER_COMPOSE) exec postgres psql -U probod -d probod
 
 compose/step-ca/certs/root_ca.crt:
-	# step-ca runs as UID 1000 and must be able to write into the bind mount
-	# on Linux CI (Docker Desktop often masks this locally).
+	# step-ca runs as UID 1000 and creates 0700 dirs; open them for the
+	# host user so later `go list ./...` can walk the bind mount on Linux.
 	@$(MKDIR) compose/step-ca
 	@chmod a+rwx compose/step-ca
 	$(DOCKER_COMPOSE) up -d acme-http-01-proxy step-ca
@@ -435,6 +435,7 @@ compose/step-ca/certs/root_ca.crt:
 		i=$$((i + 1)); \
 	done
 	@test -f $@ || ($(DOCKER_COMPOSE) logs step-ca >&2; echo "step-ca root CA not ready" >&2; exit 1)
+	@chmod -R a+rX compose/step-ca
 
 compose/keycloak/certs/cert.pem:
 	$(MKDIR) ./compose/keycloak/certs
diff --git a/apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageDomainsSection.tsx b/apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageDomainsSection.tsx
index 7efd9711a..60f2cb312 100644
--- a/apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageDomainsSection.tsx
+++ b/apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageDomainsSection.tsx
@@ -67,8 +67,8 @@ export function CompliancePageDomainsSection(props: {
 
         {customDomain
           ? (
-            <CompliancePageDomainCard fKey={customDomain} />
-          )
+              <CompliancePageDomainCard fKey={customDomain} />
+            )
           : organization.canCreateCustomDomain && (
             <div className="flex flex-col items-center justify-center gap-3 rounded-lg border border-dashed border-border-solid px-4 py-8">
               <p className="max-w-md text-center text-sm text-txt-tertiary">