diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 46043f8..3b21f30 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,13 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm boundary
-      - run: pnpm -r typecheck
+      # iios-service uses Prisma: generate the client so its generated types
+      # (schema enums, Prisma.InputJsonValue) are available for typecheck/build.
+      - run: pnpm --filter @insignia/iios-service prisma:generate
+      # Build before typecheck: the @insignia/* workspace packages publish their
+      # types via built dist/*.d.ts, so consumers (iios-kernel-client, etc.)
+      # can only resolve them once dist exists. Typechecking first fails with
+      # TS2307 "Cannot find module '@insignia/iios-contracts'".
       - run: pnpm -r build
+      - run: pnpm -r typecheck
       - run: pnpm test