diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d3a227ff..9b3c9fcd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -504,10 +504,26 @@ jobs:
         working-directory: cli
 
       - name: Publish to npm
-        run: npm publish --access public --provenance
         working-directory: cli
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          # Check if package version already exists on registry
+          PKG_NAME=$(node -p "require('./package.json').name")
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/${PKG_NAME}/${PKG_VERSION}")
+          if [ "$HTTP_CODE" = "200" ]; then
+            echo "::warning::Version ${PKG_VERSION} already exists on npm, skipping publish"
+            exit 0
+          fi
+          # First publish of a new package: --provenance requires the package to exist
+          # so we attempt with provenance first, fall back without it on 404
+          if npm publish --access public --provenance 2>&1 | tee /tmp/npm-publish.log; then
+            echo "Published with provenance"
+          elif grep -q "404" /tmp/npm-publish.log; then
+            echo "Package not yet on registry, publishing without provenance for initial seed..."
+            npm publish --access public
+          fi
 
   # ──────────────────────────────────────────────────
   # Quality Gate Summary
diff --git a/Dockerfile.worker b/Dockerfile.worker
index 5a7ba5a3..72ee9f40 100644
--- a/Dockerfile.worker
+++ b/Dockerfile.worker
@@ -11,6 +11,11 @@ RUN for i in 1 2 3; do \
       (echo "bun install attempt $i failed, retrying in 10s..." && sleep 10); \
     done
 
+# Copy source into a staging layer so COPY --from has the files
+FROM base AS source
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
 # Production image
 FROM oven/bun:1 AS runner
 WORKDIR /app
@@ -23,15 +28,15 @@ RUN mkdir -p /data/repositories /data/storage /data/cache && \
     chown -R bun:bun /data
 
 # Copy node_modules and source
-COPY --from=deps --chown=bun:bun /app/node_modules ./node_modules
-COPY --from=deps --chown=bun:bun /app/package.json ./
-COPY --from=deps --chown=bun:bun /app/cli ./cli
-COPY --from=deps --chown=bun:bun /app/tsconfig.json ./
+COPY --from=source --chown=bun:bun /app/node_modules ./node_modules
+COPY --from=source --chown=bun:bun /app/package.json ./
+COPY --from=source --chown=bun:bun /app/cli ./cli
+COPY --from=source --chown=bun:bun /app/tsconfig.json ./
 
 # Copy source files needed for worker
-COPY --from=deps --chown=bun:bun /app/src/lib ./src/lib
-COPY --from=deps --chown=bun:bun /app/src/db ./src/db
-COPY --from=deps --chown=bun:bun /app/scripts/worker.ts ./scripts/worker.ts
+COPY --from=source --chown=bun:bun /app/src/lib ./src/lib
+COPY --from=source --chown=bun:bun /app/src/db ./src/db
+COPY --from=source --chown=bun:bun /app/scripts/worker.ts ./scripts/worker.ts
 
 # Set environment variables
 ENV NODE_ENV=production
diff --git a/src/lib/config.ts b/src/lib/config.ts
index 46d9d57e..10909f54 100644
--- a/src/lib/config.ts
+++ b/src/lib/config.ts
@@ -10,10 +10,12 @@ export function loadConfig() {
     try {
       const config = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"));
       
-      // Override process.env with config values if they exist
-      if (config.DATABASE_URL) process.env.DATABASE_URL = config.DATABASE_URL;
-      if (config.DATABASE_DRIVER) process.env.DATABASE_DRIVER = config.DATABASE_DRIVER;
-      if (config.REDIS_URL) process.env.REDIS_URL = config.REDIS_URL;
+      // Only set env vars from config.json if they aren't already set in the
+      // environment.  CI injects DATABASE_URL etc. via process.env and those
+      // must never be overridden by a stale data/config.json on disk.
+      if (config.DATABASE_URL && !process.env.DATABASE_URL) process.env.DATABASE_URL = config.DATABASE_URL;
+      if (config.DATABASE_DRIVER && !process.env.DATABASE_DRIVER) process.env.DATABASE_DRIVER = config.DATABASE_DRIVER;
+      if (config.REDIS_URL && !process.env.REDIS_URL) process.env.REDIS_URL = config.REDIS_URL;
       
       // Store flag in process.env so we don't need to read FS constantly
       process.env.OPENCODEHUB_CONFIGURED = "true";