diff --git a/.env.ci b/.env.ci
new file mode 100644
index 0000000..5825c26
--- /dev/null
+++ b/.env.ci
@@ -0,0 +1,46 @@
+# Stub env for Gitea Actions / local CI (no production secrets).
+# Copied to .env.local by .gitea/workflows/build.yml before composer install.
+
+APP_ENV=dev
+APP_DEBUG=0
+APP_SECRET=ci-not-a-real-secret-change-me-32b
+SYMFONY_DEPRECATIONS_HELPER=999999
+
+DATABASE_URL="postgresql://ci:ci@127.0.0.1:5432/ci?serverVersion=16&charset=utf8"
+DATABASE_CABINET_URL="postgresql://ci:ci@127.0.0.1:5432/ci_cabinet?serverVersion=16&charset=utf8"
+DATABASE_BITRIX_URL="mysql://ci:ci@127.0.0.1:3306/ci?serverVersion=8.0"
+
+REDIS_URL=redis://127.0.0.1:6379
+MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
+MAILER_DSN=null://null
+MAILER_ACCESS_TOKEN=ci-mailer-token
+LOCK_DSN=sqlite:///%kernel.project_dir%/var/lock.db
+
+JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
+JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
+JWT_PASSPHRASE=
+
+AES_SECRET_KEY=ci-aes-secret-key-32bytes-min!!
+AES_CIPHER_METHOD=aes-256-cbc
+
+CORS_ALLOW_ORIGIN="['http://admin.test.sova.local']"
+API_BASE_URL=http://api.test.sova.local
+API_PUBLIC_URL=http://api.test.sova.local
+INTEGRATIONS_STUB_MODE=true
+API_CLIENT=sova-ci-bot
+
+SMSRU_URL=http://localhost
+SMSRU_TOKEN=noop
+SMSRU_SENDER=noop
+SMS4B_URL=http://localhost
+SMS4B_TOKEN=noop
+SMS4B_SENDER=noop
+MIS_URL=http://localhost
+WIDGET_API_URL=http://localhost
+BITRIX_URL=http://localhost
+SMARTCAPTCHA_URL=http://localhost
+SMARTCAPTCHA_KEY=noop
+CT_URL=http://localhost
+CT_PARAMS=91:1:token
+
+VAR_DUMPER_SERVER=127.0.0.1:9912
diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index ea2c2a2..33548b1 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -21,6 +21,12 @@ jobs:
         with:
           php-version: '8.4'
           extensions: pdo_pgsql, redis, intl, zip, gd
+      - name: Prepare CI environment
+        run: |
+          cp .env.ci .env.local
+          mkdir -p config/jwt var
+          openssl genrsa -out config/jwt/private.pem 2048
+          openssl rsa -pubout -in config/jwt/private.pem -out config/jwt/public.pem
       - run: composer install --prefer-dist --no-interaction
       - run: composer phpunit || true
       - run: composer audit || true