diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 306b1eb..cf6fd55 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -55,14 +55,16 @@ env:
     ${{ secrets.RSYNC_SSH_KEY }}
 
 jobs:
-  build:
-    name: Build api + worker + web
+  # The rust runner has cargo + musl but no node; the fedora runner has
+  # node + pnpm but no cargo — so the build is split across the two images.
+  build-binaries:
+    name: Build api + worker (static musl)
     runs-on: rust
     steps:
       - uses: actions/checkout@v4
 
-      # The `rust` runner image provides cargo/clippy/rustfmt, musl-gcc, the
-      # x86_64-unknown-linux-musl std, and node. No package installs at run time.
+      # The `rust` runner image provides cargo/clippy/rustfmt, musl-gcc, and the
+      # x86_64-unknown-linux-musl std. No package installs at run time.
       - name: Lint + test (deploy gate)
         run: |
           cargo fmt --check --all
@@ -72,15 +74,6 @@ jobs:
       - name: Build moments-api + moments-worker (static musl release)
         run: cargo build --release --target "${MUSL_TARGET}" -p moments-api -p moments-worker
 
-      - name: Build web (vite client + prerender)
-        run: |
-          # The gongfoo rust image ships node + npm but not corepack (Fedora's
-          # nodejs package omits it), and the build job runs as root — so install
-          # pnpm globally via npm. Bake pnpm into the runner image to drop this.
-          npm install -g pnpm@10
-          pnpm --dir ui install --frozen-lockfile
-          pnpm --dir ui run build
-
       - name: Stage binaries
         run: |
           mkdir --parents artifacts
@@ -91,13 +84,24 @@ jobs:
         with: { name: moments-api, path: artifacts/moments-api, retention-days: 1 }
       - uses: actions/upload-artifact@v3
         with: { name: moments-worker, path: artifacts/moments-worker, retention-days: 1 }
+
+  build-web:
+    name: Build prerendered web
+    runs-on: fedora-44
+    steps:
+      - uses: actions/checkout@v4
+      # The fedora-44 runner image bakes in node + pnpm (+ rsync) — no install.
+      - name: Build web (vite client + prerender)
+        run: |
+          pnpm --dir ui install --frozen-lockfile
+          pnpm --dir ui run build
       - uses: actions/upload-artifact@v3
         with: { name: web-dist, path: ui/dist, retention-days: 1 }
 
   deploy-api:
     name: Deploy moments-api to nikola
-    needs: build
-    runs-on: fedora-43
+    needs: build-binaries
+    runs-on: fedora-44
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3
@@ -209,8 +213,8 @@ jobs:
 
   deploy-worker:
     name: Deploy moments-worker to frootmig
-    needs: build
-    runs-on: fedora-43
+    needs: build-binaries
+    runs-on: fedora-44
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3
@@ -299,8 +303,8 @@ jobs:
 
   deploy-web:
     name: Deploy web to oolon
-    needs: build
-    runs-on: fedora-43
+    needs: build-web
+    runs-on: fedora-44
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3
diff --git a/.gitea/workflows/refresh.yml b/.gitea/workflows/refresh.yml
index 4a197c1..f774683 100644
--- a/.gitea/workflows/refresh.yml
+++ b/.gitea/workflows/refresh.yml
@@ -33,13 +33,11 @@ env:
 jobs:
   build-web:
     name: Rebuild prerendered web
-    runs-on: rust            # image has node; we only need the web toolchain here
+    runs-on: fedora-44       # image bakes in node + pnpm; that's all we need here
     steps:
       - uses: actions/checkout@v4
       - name: Build web (vite client + prerender)
         run: |
-          # gongfoo rust image has node + npm but not corepack; job runs as root.
-          npm install -g pnpm@10
           pnpm --dir ui install --frozen-lockfile
           pnpm --dir ui run build
       - uses: actions/upload-artifact@v3
@@ -48,7 +46,7 @@ jobs:
   deploy-web:
     name: Deploy refreshed web to oolon
     needs: build-web
-    runs-on: fedora-43
+    runs-on: fedora-44
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3