diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f626f5a..bfdd1a5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -125,7 +125,10 @@ jobs:
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
       - name: build zImage + rv1106-warden.dtb
         env:
-          WORK: ${{ github.workspace }}/kbuild-out
+          # WORK must be OUTSIDE the repo checkout: build-kernel.sh applies the patch
+          # series with `git apply`, which silently ignores out-of-subdir paths when
+          # run inside another git repo (issue #1). $RUNNER_TEMP is outside the checkout.
+          WORK: ${{ runner.temp }}/kbuild-out
           JOBS: 4   # belt-and-braces bound in addition to the runner's cgroup cap
           # The kernel is freestanding; use the stable generic arm cross toolchain
           # (Debian gcc-arm-linux-gnueabihf on the runner) rather than depending on
@@ -136,8 +139,8 @@ jobs:
         with:
           name: kernel-rv1106
           path: |
-            ${{ github.workspace }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
-            ${{ github.workspace }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
+            ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
+            ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
           retention-days: 14
 
   badges:
diff --git a/build/build-kernel.sh b/build/build-kernel.sh
index 6cf9df9..4e5c832 100755
--- a/build/build-kernel.sh
+++ b/build/build-kernel.sh
@@ -66,14 +66,34 @@ rm -rf "$SRC"
 log "extracting pristine"
 tar -C "$WORK" -xf "$TB"
 
-# 3. apply the patch series in order
+# 3. apply the patch series in order (fail loudly — never echo a lie)
 log "applying patch series"
 for p in "$PATCHES"/*.patch; do
-  git -C "$SRC" apply --whitespace=nowarn "$p" 2>/dev/null \
-    || patch -d "$SRC" -p1 --no-backup-if-mismatch < "$p"
+  if git -C "$SRC" apply --whitespace=nowarn "$p" 2>/dev/null; then
+    :
+  elif patch -d "$SRC" -p1 --forward --no-backup-if-mismatch < "$p" >/dev/null 2>&1; then
+    :
+  else
+    echo "FATAL: failed to apply $(basename "$p")" >&2
+    exit 1
+  fi
   echo "  applied $(basename "$p")"
 done
 
+# Guard against a SILENT no-op: `git apply` run from inside another git repo's
+# subdirectory ignores out-of-subdir paths and exits 0 without applying anything
+# (issue #1). $WORK must therefore live OUTSIDE any git checkout. Assert that a known
+# product of the series actually landed on disk, so this can never masquerade as
+# success again.
+SENTINEL="$SRC/arch/arm/boot/dts/rockchip/rv1106-warden.dts"
+[ -f "$SENTINEL" ] || {
+  echo "FATAL: patch series did not apply (missing $SENTINEL)." >&2
+  echo "       Is \$WORK inside a git repo? git apply silently ignores out-of-subdir" >&2
+  echo "       paths there — point WORK at a dir outside any checkout (e.g. \$RUNNER_TEMP)." >&2
+  exit 1
+}
+log "patch series applied ($(basename "$SENTINEL") present)"
+
 # 4. configure
 log "configuring (warden_defconfig)"
 cp "$HERE/warden_defconfig" "$SRC/.config"