diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 89002e7..192810f 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -35,9 +35,16 @@ jobs:
       - name: Build without contract-time key persistence
         run: |
           key_dir="$HOME/.aspnet/DataProtection-Keys"
-          before="$(find "$key_dir" -type f -name 'key-*.xml' 2>/dev/null | wc -l)"
+          count_keys() {
+            if [ -d "$key_dir" ]; then
+              find "$key_dir" -type f -name 'key-*.xml' | wc -l
+            else
+              printf '0\n'
+            fi
+          }
+          before="$(count_keys)"
           dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
-          after="$(find "$key_dir" -type f -name 'key-*.xml' 2>/dev/null | wc -l)"
+          after="$(count_keys)"
           test "$before" -eq "$after"
 
       - name: Verify EF migration model
@@ -88,9 +95,16 @@ jobs:
         run: |
           dotnet restore backend-tests/Nexus.Api.Tests.csproj
           key_dir="$HOME/.aspnet/DataProtection-Keys"
-          before="$(find "$key_dir" -type f -name 'key-*.xml' 2>/dev/null | wc -l)"
+          count_keys() {
+            if [ -d "$key_dir" ]; then
+              find "$key_dir" -type f -name 'key-*.xml' | wc -l
+            else
+              printf '0\n'
+            fi
+          }
+          before="$(count_keys)"
           dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
-          after="$(find "$key_dir" -type f -name 'key-*.xml' 2>/dev/null | wc -l)"
+          after="$(count_keys)"
           test "$before" -eq "$after"
 
       - name: Run all container-backed contracts