diff --git a/scripts/ci-run.sh b/scripts/ci-run.sh
index 92c1042..2451d87 100755
--- a/scripts/ci-run.sh
+++ b/scripts/ci-run.sh
@@ -11,7 +11,7 @@
 #   CI_COMMIT_SHA    — commit SHA
 #   GITEA_TOKEN      — Gitea API token (from Gitea Actions secret PAT_TOKEN)
 
-set -euo pipefail
+set -uo pipefail
 
 JOB="${1:-}"
 if [ -z "$JOB" ]; then
@@ -23,11 +23,14 @@ fi
 # Go toolchain env vars (GOROOT, GOPATH, GOCACHE, GOMODCACHE are in the
 # systemVars deny-list). Re-derive them from the `go` binary on PATH so
 # Go commands work in the shell-isolated executor.
+echo "ci-run: PATH=$PATH" >&2
+echo "ci-run: which go=$(command -v go 2>/dev/null || echo 'not found')" >&2
 if command -v go >/dev/null 2>&1; then
-  export GOROOT="${GOROOT:-$(go env GOROOT)}"
-  export GOPATH="${GOPATH:-$(go env GOPATH)}"
-  export GOCACHE="${GOCACHE:-$(go env GOCACHE)}"
-  export GOMODCACHE="${GOMODCACHE:-$(go env GOMODCACHE)}"
+  export GOROOT="${GOROOT:-$(go env GOROOT 2>/dev/null || echo "")}"
+  export GOPATH="${GOPATH:-$(go env GOPATH 2>/dev/null || echo "$HOME/go")}"
+  export GOCACHE="${GOCACHE:-$(go env GOCACHE 2>/dev/null || echo "$HOME/.cache/go-build")}"
+  export GOMODCACHE="${GOMODCACHE:-$(go env GOMODCACHE 2>/dev/null || echo "$HOME/go/pkg/mod")}"
+  echo "ci-run: GOROOT=$GOROOT GOPATH=$GOPATH GOCACHE=$GOCACHE GOMODCACHE=$GOMODCACHE" >&2
 fi
 
 info() { echo "ci-run: $*"; }
@@ -69,17 +72,20 @@ case "$JOB" in
 
   # ── build ──────────────────────────────────────────────────────────
   build)
+    info "building orca binary..."
     VERSION="${CI_COMMIT_BRANCH:-dev}"
     GIT_COMMIT="${CI_COMMIT_SHA:-unknown}"
     BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    info "VERSION=$VERSION GIT_COMMIT=$GIT_COMMIT BUILD_TIME=$BUILD_TIME"
     LDFLAGS="-s -w \
       -X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
       -X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
       -X git.cloudinit.dev/coreci/orca/internal/cli.buildTime=${BUILD_TIME}"
     mkdir -p bin
-    go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca
-    file bin/orca
-    ./bin/orca version
+    info "running: go build -trimpath -ldflags=... -o bin/orca ./cmd/orca"
+    go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca 2>&1 || err "go build failed with exit $?"
+    file bin/orca 2>/dev/null || echo "file command not available"
+    ./bin/orca version 2>&1 || echo "orca version failed"
     ;;
 
   # ── test (REQ-031: -race) ─────────────────────────────────────────