diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
index 2f5c86b51..03c916333 100644
--- a/.github/workflows/deploy-production.yml
+++ b/.github/workflows/deploy-production.yml
@@ -33,6 +33,18 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen --ignore-scripts
 
+      - name: Ensure database extensions
+        working-directory: packages/db
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL_UNPOOLED }}
+        run: |
+          bun --eval '
+          import { neon } from "@neondatabase/serverless";
+
+          const sql = neon(process.env.DATABASE_URL);
+          await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`;
+          '
+
       - name: Run database migrations
         working-directory: packages/db
         env:
@@ -474,7 +486,13 @@ jobs:
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        run: bunx wrangler deploy
+        run: |
+          if [ -z "$CLOUDFLARE_API_TOKEN" ] || [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
+            echo "Skipping Cloudflare worker deploy because Cloudflare credentials are not configured."
+            exit 0
+          fi
+
+          bunx wrangler deploy
 
   deploy-docs:
     name: Deploy Docs to Vercel