diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 006ac79..e28095f 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -41,14 +41,11 @@ jobs:
             - name: Checkout
               uses: actions/checkout@v4
 
-            - name: Inject Auth
-              run: echo "//git.mcpeakdev.com/api/packages/McPeakDev/npm/:_authToken=${BUN_AUTH_TOKEN}" > /root/.npmrc
-              env:
-                  BUN_AUTH_TOKEN: ${{ secrets.BUN_AUTH_TOKEN }}
-
             - name: Install dependencies
               run: bun install --frozen-lockfile
               working-directory: ui
+              env:
+                  BUN_AUTH_TOKEN: ${{ secrets.BUN_AUTH_TOKEN }}
 
             - name: Audit dependencies
               run: bun audit || true
@@ -92,3 +89,5 @@ jobs:
                       git.mcpeakdev.com/mcpeakdev/mercury:latest
                   cache-from: type=registry,ref=git.mcpeakdev.com/mcpeakdev/mercury:latest
                   cache-to: type=inline
+                  secrets: |
+                      bun_auth_token=${{ secrets.BUN_AUTH_TOKEN }}
diff --git a/Dockerfile b/Dockerfile
index fcf3464..aa57776 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,6 +2,10 @@
 FROM oven/bun:1-alpine AS ui-builder
 WORKDIR /ui
 COPY ui/ .
+RUN --mount=type=secret,id=bun_auth_token \
+    printf '//git.mcpeakdev.com/api/packages/McPeakDev/npm/:_authToken=%s\n@nychthemeron:registry=https://git.mcpeakdev.com/api/packages/McPeakDev/npm/\n' \
+    "$(cat /run/secrets/bun_auth_token)" > .npmrc && \
+    bun install --frozen-lockfile
 RUN bun run build
 
 # Stage 2: Build Rust API
diff --git a/ui/.gitignore b/ui/.gitignore
index edf52b5..27420d2 100644
--- a/ui/.gitignore
+++ b/ui/.gitignore
@@ -1,5 +1,6 @@
 node_modules/
 dist/
+.npmrc
 
 # vue-tsc emit artifacts (should never appear in src/ — noEmit is set)
 src/**/*.vue.js
diff --git a/ui/bunfig.toml b/ui/bunfig.toml
new file mode 100644
index 0000000..04a6c1c
--- /dev/null
+++ b/ui/bunfig.toml
@@ -0,0 +1,2 @@
+[install.scopes]
+"@nychthemeron" = { url = "https://git.mcpeakdev.com/api/packages/McPeakDev/npm/" }