diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 67a72de..024e64f 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -667,6 +667,7 @@ jobs:
 
   frontend-deps-major:
     name: Frontend major deps
+    continue-on-error: true
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -705,10 +706,11 @@ jobs:
             if (major.length) {
               console.log('Major (out-of-range) updates available — review carefully:');
               major.forEach(([k, v]) => console.log('  ' + k + ': ' + v.current + ' (wanted: ' + v.wanted + ') -> latest: ' + v.latest));
+              process.exit(1);
             } else {
               console.log('All dependencies within semver range, no major updates');
+              process.exit(0);
             }
-            process.exit(0);
           });
           "
 
@@ -910,8 +912,10 @@ jobs:
 
       - name: Validate nginx config
         run: |
-          mkdir -p /etc/nginx/http.d
+          mkdir -p /etc/nginx/http.d /etc/nginx/certs
           cp $(pwd)/nginx/conf.d/default.conf /etc/nginx/http.d/default.conf
+          # Create dummy TLS certs so nginx -t can resolve ssl_certificate paths
+          openssl req -x509 -nodes -days 1 -newkey rsa:2048 -keyout /etc/nginx/certs/privkey.pem -out /etc/nginx/certs/fullchain.pem -subj "/CN=localhost" 2>/dev/null
           # Add compose service names so nginx -t can resolve upstreams
           echo "127.0.0.1 backend sabredav" >> /etc/hosts
           nginx -t