diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 01d6cbd99..fdb404177 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -227,6 +227,23 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-store-
 
+      - name: Install dependencies
+        working-directory: CeraUI
+        run: bun install --frozen-lockfile
+
+      # FIRST, and that ordering is the point. Several frontend specs render a
+      # full dialog SYNCHRONOUSLY against vitest's 5 s default, so they are
+      # sensitive to how loaded the runner already is. Run after this job's .deb
+      # builds and lint, the heaviest of them took 5480-5544 ms and timed out on
+      # two consecutive release dispatches — while the same commit passed in
+      # build-check, whose test-fe job runs vitest immediately after `bun install`
+      # on a fresh runner. This reproduces those conditions exactly: nothing but
+      # checkout, Bun and install precede it. Do not move it below the packaging
+      # steps, and do not "tidy" the ruby/fpm install back above it.
+      - name: Frontend unit tests (vitest)
+        working-directory: CeraUI
+        run: bun run --filter frontend test
+
       - name: Cache Ruby gems (fpm)
         uses: actions/cache@v6
         with:
@@ -245,10 +262,6 @@ jobs:
           sudo apt-get install -y ruby-dev gcc g++
           sudo gem install --no-document fpm
 
-      - name: Install dependencies
-        working-directory: CeraUI
-        run: bun install --frozen-lockfile
-
       - name: Run release/package contracts
         working-directory: CeraUI
         run: bun run test:release-package-contracts
@@ -275,9 +288,19 @@ jobs:
         working-directory: CeraUI
         run: bun run test:service-contract
 
+      # Per-workspace rather than the combined `bun run test`, and the FRONTEND
+      # suite deliberately lives in its own job below. These three run after a
+      # .deb build, a full lint/typecheck and a service contract on this runner;
+      # the frontend suite is the one that cannot absorb that (see that job).
+      # Per-workspace rather than the combined `bun run test`, because the
+      # frontend suite has already run above, on a fresh runner. Together these
+      # cover exactly what `bun run test` chained: rpc, i18n, frontend, backend.
       - name: Run unit tests
         working-directory: CeraUI
-        run: bun run test
+        run: |
+          bun run --filter @ceraui/rpc test
+          bun run --filter @ceraui/i18n test
+          bun run --filter backend test
 
   build-ceraui-system:
     name: Build CeraUI Full System