diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 206f477..aa7e990 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,4 +1,4 @@
-# Tests the hub (against a real Postgres: embedded, downloaded by the tests and cached) and builds it.
+# Tests the hub (against a real Postgres, a service container here) and builds it.
 name: CI
 
 on:
@@ -12,7 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     env:
       GOPRIVATE: git.t5de.dev
-      T5DE_PG_CACHE: /tmp/t5de-hub-postgres
+      # Jobs run as root, which embedded Postgres refuses: the tests use this service instead.
+      T5DE_TEST_DB: postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_PASSWORD: postgres
+        options: >-
+          --health-cmd "pg_isready -U postgres" --health-interval 2s --health-timeout 5s --health-retries 30
     steps:
       - uses: actions/checkout@v4
 
@@ -20,12 +28,6 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Cache Postgres for the tests
-        uses: actions/cache@v4
-        with:
-          path: /tmp/t5de-hub-postgres
-          key: embedded-postgres-${{ runner.os }}-${{ hashFiles('go.sum') }}
-
       - name: Test
         run: |
           unformatted=$(gofmt -l .)
diff --git a/README.md b/README.md
index 3dd8f67..f5c48ab 100644
--- a/README.md
+++ b/README.md
@@ -30,4 +30,4 @@ To point a T5DE proxy at it: `t5de-proxy signin -hub http://127.0.0.1:8080`.
 ## Tests
 
 `go test ./...` runs everything, the website and API against a real Postgres (embedded, downloaded on first run
-and cached; `T5DE_PG_CACHE` sets where) and a fake IMVU API.
+and cached; `T5DE_PG_CACHE` sets where), or the Postgres at `T5DE_TEST_DB` (as CI does), and a fake IMVU API.
diff --git a/internal/web/web_test.go b/internal/web/web_test.go
index 2a861b1..cc45649 100644
--- a/internal/web/web_test.go
+++ b/internal/web/web_test.go
@@ -33,6 +33,11 @@ import (
 var dbURL string
 
 func TestMain(m *testing.M) {
+	// CI gives a Postgres of its own (embedded Postgres won't run as root, as CI jobs do).
+	if url := os.Getenv("T5DE_TEST_DB"); url != "" {
+		dbURL = url
+		os.Exit(m.Run())
+	}
 	dir, _ := os.MkdirTemp("", "t5de-hub-test")
 	cache := os.Getenv("T5DE_PG_CACHE")
 	if cache == "" {
@@ -104,7 +109,9 @@ func newHub(t *testing.T) *hub {
 		t.Fatal(err)
 	}
 	admin.Close(ctx)
-	st, err := store.Open(ctx, strings.Replace(dbURL, "/postgres?", "/"+db+"?", 1))
+	u, _ := url.Parse(dbURL)
+	u.Path = "/" + db
+	st, err := store.Open(ctx, u.String())
 	if err != nil {
 		t.Fatal(err)
 	}