diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index e56a079..d5139fa 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -5,19 +5,30 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    container: node:22-bookworm
+    defaults:
+      run:
+        shell: bash
     services:
       postgres:
         image: postgres:17
         env:
           POSTGRES_PASSWORD: test-only
           POSTGRES_DB: meguri_test
-        ports: ["5432:5432"]
         options: >-
           --health-cmd "pg_isready -U postgres"
           --health-interval 5s --health-timeout 5s --health-retries 10
     env:
-      MEGURI_TEST_DATABASE_URL: postgresql://postgres:test-only@127.0.0.1:5432/meguri_test
+      MEGURI_TEST_DATABASE_URL: postgresql://postgres:test-only@postgres:5432/meguri_test
     steps:
+      - name: Install build and database tools
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends build-essential pkg-config libssl-dev postgresql-client
+      - name: Check PostgreSQL from the job container
+        env:
+          PGCONNECT_TIMEOUT: "5"
+        run: psql "$MEGURI_TEST_DATABASE_URL" -X -v ON_ERROR_STOP=1 -c 'SELECT 1'
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@1.97.0
         with:
@@ -35,7 +46,7 @@ jobs:
       - run: npx playwright install --with-deps chromium
       - name: Browser and API checks
         env:
-          DATABASE_URL: postgresql://postgres:test-only@127.0.0.1:5432/meguri_test
+          DATABASE_URL: postgresql://postgres:test-only@postgres:5432/meguri_test
           MEGURI_SEED_DEMO: "true"
           MEGURI_ALLOW_SIGNUP: "true"
           MEGURI_BROWSER_CHANNEL: chromium
diff --git a/docs/development.md b/docs/development.md
index 126e002..a9077e2 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -16,6 +16,8 @@ cargo test
 
 PostgreSQL integration tests require `MEGURI_TEST_DATABASE_URL` pointing at a disposable database, with CREATEDB for the isolated demo-lifecycle tests. Run `cargo test --test integration -- --ignored --test-threads=1`. Most tests create isolated workspaces/users; lifecycle tests create and remove uniquely named databases to test protection, reset, retention, and reseeding. Never use a production database.
 
+CI uses an explicit Debian Node job container and the PostgreSQL service hostname `postgres`, for both Gitea Actions and GitHub Actions. Loopback inside the job does not reach the database service. No host database port is published. A bounded authenticated `psql SELECT 1` check runs before compilation; database networking/authentication failures stop the job rather than producing a pool timeout in every integration test. The application and browser tests still share job-container loopback.
+
 Browser checks: sign in; inspect the calendar; create a request as one user and approve it as another; verify the publication status separately; verify that a user outside the workspace cannot read it. Use both desktop and narrow viewports. A test failure is not a reason to relax an authorization or scheduling invariant.
 
 ## Operational limitations
diff --git a/docs/testing.md b/docs/testing.md
index 276f044..2660f11 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -35,7 +35,11 @@ Scheduling errors are product failures. A change to ownership, time boundaries,
 
 The fake models JSM responses and is not a substitute for live acceptance. New endpoints need verification against official documentation, a wire assertion, and a failure/recovery test. Do not make the fake accept an invented contract to get tests green.
 
+CI database preflight connects from the same job container and with the same URL as integration tests. Service health alone does not verify that the job can reach PostgreSQL. Diagnose connection failures separately from application assertions; do not skip the integration suite when preflight fails.
+
 Before enabling a provider in production: publish a preview to its dedicated test team, compare the actual timeline, repeat unchanged, interrupt a partial publication, introduce external drift, verify conflict and explicit overwrite, and exercise escalation/routing on the target subscription. Record evidence and limitations.
+
+See [JSM environment and acceptance preparation](jsm-acceptance.md) for current test-site options and the live verification sequence.
 ## Additional regression cases
 
 Cover independent handovers and dependent fallback boundaries, DST rejection, country-specific coverage, scoped directory selection, email contacts without access, import quoting/BOM/duplicates/errors/stale previews, atomic working-interval propagation, and exact JSM email resolution before writes. Browser coverage includes person selection by email, absence selection, reactive CSV preview/import, and readable escalation/routing flows on desktop and mobile.