diff --git a/.gitea/workflows/cicd.yaml b/.gitea/workflows/cicd.yaml
index 7010907..b77fde0 100644
--- a/.gitea/workflows/cicd.yaml
+++ b/.gitea/workflows/cicd.yaml
@@ -973,7 +973,7 @@ jobs:
           FRONTEND_BASE_CACHE_REF="${FRONTEND_BASE_REPO}:cache"
 
           retry_registry_op pull "${FRONTEND_BASE_CACHE_REF}" 5 3 || true
-          DOCKER_BUILDKIT=1 docker build -f Dockerfile.frontend \
+          BUILDKIT_NO_CLIENT_TOKEN=1 DOCKER_BUILDKIT=1 docker build -f Dockerfile.frontend \
             --target deps \
             --cache-from "${FRONTEND_BASE_CACHE_REF}" \
             --build-arg BUILDKIT_INLINE_CACHE=1 \
diff --git a/Dockerfile.frontend b/Dockerfile.frontend
index a58a56c..5cfcca3 100644
--- a/Dockerfile.frontend
+++ b/Dockerfile.frontend
@@ -4,6 +4,7 @@ FROM node:24-alpine AS deps
 WORKDIR /app
 
 COPY frontend/package.json frontend/yarn.lock frontend/.yarnrc.yml ./
+COPY frontend/.yarn/releases/ ./.yarn/releases/
 RUN set -eux; \
 		retry() { \
 			attempts="$1"; shift; \
@@ -19,14 +20,17 @@ RUN set -eux; \
 			done; \
 			return 1; \
 		}; \
-		corepack enable; \
-		retry 5 corepack prepare yarn@4.10.3 --activate; \
-		retry 5 yarn install --immutable
+		YARN_CLI="$(ls .yarn/releases/yarn-*.cjs | head -n 1)"; \
+		if [ -z "${YARN_CLI}" ]; then \
+			echo "Missing vendored Yarn release in .yarn/releases"; \
+			exit 1; \
+		fi; \
+		retry 5 node "${YARN_CLI}" install --immutable
 
 FROM deps AS build
 
 COPY frontend/ .
-RUN yarn build
+RUN node .yarn/releases/yarn-4.10.3.cjs build
 
 FROM nginx:alpine AS production