diff --git a/.github/workflows/ci-cd-web-desktop.yml b/.github/workflows/ci-cd-web-desktop.yml
index 5b7bea7..9a644e6 100644
--- a/.github/workflows/ci-cd-web-desktop.yml
+++ b/.github/workflows/ci-cd-web-desktop.yml
@@ -245,7 +245,11 @@ jobs:
           echo "$LIST" | sed "1,${KEEP}d" | while read dir; do
             [ -z "$dir" ] && continue
             echo "Removing $dir"
-            rm -rf "$dir" || echo "Failed to remove $dir"
+            rm -rf "$dir" || {
+              echo "Local rm failed, falling back to docker (root) cleanup for $dir..."
+              docker run --rm -v "$dir":/target alpine:3 sh -lc 'rm -rf /target/* /target/.[!.]* /target/..?* 2>/dev/null || true; rmdir /target || true' || true
+              rmdir "$dir" 2>/dev/null || true
+            }
           done
           echo "Disk usage (top 10 under $ROOT):"
           du -sh "$ROOT"/* 2>/dev/null | sort -rh | head -n 10 || true
@@ -324,12 +328,13 @@ jobs:
           docker run --rm -i \
             -v "$EFFECTIVE_APP_DIR":/app \
             -w /app \
+            -e PNPM_STORE_DIR=/tmp/pnpm-store \
             -e CONVEX_SELF_HOSTED_URL \
             -e CONVEX_SELF_HOSTED_ADMIN_KEY \
             -e MACHINE_PROVISIONING_SECRET \
             -e MACHINE_TOKEN_TTL_MS \
             -e FLEET_SYNC_SECRET \
-            node:20-bullseye bash -lc "set -euo pipefail; unset CONVEX_DEPLOYMENT; corepack enable; corepack prepare pnpm@9 --activate; pnpm install --frozen-lockfile --prod=false; \
+            node:20-bullseye bash -lc "set -euo pipefail; unset CONVEX_DEPLOYMENT; corepack enable; corepack prepare pnpm@9 --activate; mkdir -p \"${PNPM_STORE_DIR:-/tmp/pnpm-store}\"; pnpm install --frozen-lockfile --prod=false; \
               if [ -n \"$MACHINE_PROVISIONING_SECRET\" ]; then pnpm exec convex env set MACHINE_PROVISIONING_SECRET \"$MACHINE_PROVISIONING_SECRET\" -y; fi; \
               if [ -n \"$MACHINE_TOKEN_TTL_MS\" ]; then pnpm exec convex env set MACHINE_TOKEN_TTL_MS \"$MACHINE_TOKEN_TTL_MS\" -y; fi; \
               if [ -n \"$FLEET_SYNC_SECRET\" ]; then pnpm exec convex env set FLEET_SYNC_SECRET \"$FLEET_SYNC_SECRET\" -y; fi; \
@@ -350,10 +355,11 @@ jobs:
           docker run --rm -i \
             -v "$EFFECTIVE_APP_DIR":/app \
             -w /app \
+            -e PNPM_STORE_DIR=/tmp/pnpm-store \
             -e CI=true \
             -e CONVEX_SELF_HOSTED_URL \
             -e CONVEX_SELF_HOSTED_ADMIN_KEY \
-            node:20-bullseye bash -lc "set -euo pipefail; unset CONVEX_DEPLOYMENT; corepack enable; corepack prepare pnpm@9 --activate; pnpm install --frozen-lockfile --prod=false; pnpm exec convex deploy"
+            node:20-bullseye bash -lc "set -euo pipefail; unset CONVEX_DEPLOYMENT; corepack enable; corepack prepare pnpm@9 --activate; mkdir -p \"${PNPM_STORE_DIR:-/tmp/pnpm-store}\"; pnpm install --frozen-lockfile --prod=false; pnpm exec convex deploy"
 
       - name: Cleanup old convex build workdirs (keep last 2)
         run: |
@@ -365,7 +371,11 @@ jobs:
           echo "$LIST" | sed "1,${KEEP}d" | while read dir; do
             [ -z "$dir" ] && continue
             echo "Removing $dir"
-            rm -rf "$dir" || echo "Failed to remove $dir"
+            rm -rf "$dir" || {
+              echo "Local rm failed, falling back to docker (root) cleanup for $dir..."
+              docker run --rm -v "$dir":/target alpine:3 sh -lc 'rm -rf /target/* /target/.[!.]* /target/..?* 2>/dev/null || true; rmdir /target || true' || true
+              rmdir "$dir" 2>/dev/null || true
+            }
           done
 
   desktop_release: