diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d982aab..335b87c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,11 +1,34 @@
-name: Backend build and tests
+name: Backend CI
+
 on:
   pull_request:
     branches: [main, dev]
+
+permissions:
+  contents: read
+
 jobs:
-  ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@main
-    with:
-      dotnet-version: "8.0.x"
-      solution: "SeaHavenIndustries.sln"
-      run-tests: true
+  build-and-test:
+    name: Build and test
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    concurrency:
+      group: backend-ci-${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Restore
+        run: dotnet restore SeaHavenIndustries.sln
+
+      - name: Build
+        run: dotnet build SeaHavenIndustries.sln --no-restore --configuration Release
+
+      - name: Test
+        run: dotnet test SeaHavenIndustries.sln --no-build --configuration Release
diff --git a/infra/cdk/README.md b/infra/cdk/README.md
index a6cf1c1..9c30e78 100644
--- a/infra/cdk/README.md
+++ b/infra/cdk/README.md
@@ -216,6 +216,13 @@ discovery using the initiating role, so the CDK policy includes that action
 alongside the existing EC2 describe permissions. It remains resource `*`
 because `DescribeVpcs` does not support resource-level permissions.
 
+After that permission was deployed, the next exact rerun reached the S3 cleanup
+phase and failed because Elastic Beanstalk could not delete one or more
+temporary objects. The service does not expose the AWS-owned bucket/key in its
+event, so `s3:DeleteObject` is scoped to the same AWS-confirmed
+`arn:aws:s3:::elasticbeanstalk-*/*` object namespace as `GetObjectAcl`. The
+policy does not grant wildcard S3 actions or access to non-Beanstalk buckets.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index 4699358..89e1fc3 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -210,10 +210,11 @@ export class DeployDevStack extends cdk.Stack {
     deployRole.addToPolicy(
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
-        actions: ['s3:GetObjectAcl'],
-        // UpdateEnvironment also checks objects in AWS-owned Elastic Beanstalk
-        // buckets. AWS Support case 178526484500047 confirmed that the caller's
-        // identity policy must cover the service-wide bucket namespace.
+        actions: ['s3:DeleteObject', 's3:GetObjectAcl'],
+        // UpdateEnvironment also checks and removes temporary objects in
+        // AWS-owned Elastic Beanstalk buckets. AWS Support case
+        // 178526484500047 confirmed that the caller's identity policy must
+        // cover the service-wide bucket namespace.
         resources: ['arn:aws:s3:::elasticbeanstalk-*/*'],
       }),
     );