diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 13942e2..d4a8215 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -163,24 +163,34 @@ jobs:
           flutter-version: ${{ inputs.flutter-version }}
           rust-toolchain:  ${{ inputs.rust-toolchain }}
 
+      - name: Install
+        if: steps.setup.outputs.install != ''
+        run: ${{ steps.setup.outputs.install }}
+
       # A build often needs config present but not real — a Next.js build reads
       # public env at build time and fails without it. These are PLACEHOLDERS
       # supplied by the caller in plain sight, never secrets: a value that must
       # stay secret has no business being visible in a PR build log.
-      - name: Build-time configuration
-        if: inputs.build-env != ''
+      #
+      # Exported into THIS shell rather than written to $GITHUB_ENV, because
+      # GitHub refuses a few names there — NODE_OPTIONS among them, since it can
+      # inject code into node processes the runner itself spawns. That is exactly
+      # the variable a Next.js build needs: Node sizes its old-space from system
+      # RAM, which lands near 2 GB on the self-hosted pool, and `next build` sits
+      # right at that edge. Writing it to $GITHUB_ENV fails the step outright.
+      #
+      # `IFS='=' read -r k v` splits on the FIRST `=` only, so values containing
+      # `=` (URLs, base64) survive intact.
+      - name: Build
+        if: steps.setup.outputs.build != ''
         env:
           BUILD_ENV: ${{ inputs.build-env }}
         run: |
           set -euo pipefail
-          while IFS= read -r line; do
-            [ -z "$line" ] && continue
-            echo "$line" >> "$GITHUB_ENV"
-          done <<< "$BUILD_ENV"
-
-      - name: Install
-        if: steps.setup.outputs.install != ''
-        run: ${{ steps.setup.outputs.install }}
-      - name: Build
-        if: steps.setup.outputs.build != ''
-        run: ${{ steps.setup.outputs.build }}
+          if [ -n "${BUILD_ENV:-}" ]; then
+            while IFS='=' read -r k v; do
+              [ -z "$k" ] && continue
+              export "$k=$v"
+            done <<< "$BUILD_ENV"
+          fi
+          ${{ steps.setup.outputs.build }}