diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f8261a5..4694d36 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -76,41 +76,45 @@ jobs:
         run: npm run build
 
   # ====================================================================
-  # BUILD — dev/beta/release tags (skip test tags)
+  # BUILD — after tests pass (release) or directly (dev/beta)
   # ====================================================================
   build-server-core:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_server_core.yaml
     secrets: inherit
 
   build-device-agent:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_device_agent.yaml
     secrets: inherit
 
   build-dashboard:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_dashboard.yaml
     secrets: inherit
 
   # ====================================================================
-  # DOCS — release tags only (skip dev/beta/test)
+  # DOCS — after builds pass, release tags only
   # ====================================================================
   build-docs:
-    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
+    needs: [build-server-core, build-device-agent, build-dashboard]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/docs_call.yaml
     secrets: inherit
 
   # ====================================================================
-  # RELEASE — dev/beta/release tags (skip test)
+  # RELEASE — after everything passes
   # ====================================================================
   release:
-    if: "!contains(gitea.ref_name, 'test') && !failure()"
-    needs: [build-server-core, build-device-agent, build-dashboard]
+    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
+    needs: [build-server-core, build-device-agent, build-dashboard, build-docs]
     uses: ./.gitea/workflows/release_call.yaml
     with:
       prerelease: ${{ contains(gitea.ref_name, 'dev') }}