diff --git a/.github/actions/prepare-desktop-frontend/action.yml b/.github/actions/prepare-desktop-frontend/action.yml
new file mode 100644
index 00000000..6d2e9a6f
--- /dev/null
+++ b/.github/actions/prepare-desktop-frontend/action.yml
@@ -0,0 +1,38 @@
+name: Prepare desktop frontend
+description: >-
+  Builds the workspace packages the desktop frontend imports and generates its
+  gitignored marketplace JSON. Every job that runs tsc, vite, or `tauri build`
+  against apps/desktop must call this first — keeping it in one place is what
+  stops validate/release/nightly from drifting apart.
+
+inputs:
+  strict:
+    description: Pass --strict to the marketplace generator (fail on plugin data errors).
+    required: false
+    default: 'true'
+
+runs:
+  using: composite
+  steps:
+    # The desktop frontend imports @harness-kit/design-tokens and
+    # @harness-kit/ui directly, which in turn need shared + core built.
+    - name: Build workspace dependencies
+      shell: bash
+      run: |
+        pnpm --filter @harness-kit/shared build
+        pnpm --filter @harness-kit/core build
+        pnpm --filter @harness-kit/design-tokens build
+        pnpm --filter @harness-kit/ui build
+
+    # The desktop Marketplace page imports a static marketplace JSON generated
+    # from git (gitignored build output) — same pattern as the website. Without
+    # this, `tsc` fails with TS2307 on ./marketplace.generated.json.
+    - name: Generate marketplace data
+      shell: bash
+      run: |
+        STRICT=""
+        if [[ "${{ inputs.strict }}" == "true" ]]; then
+          STRICT="--strict"
+        fi
+        pnpm --filter @harness-kit/marketplace-data generate $STRICT -- \
+          --out ../../apps/desktop/src/lib/marketplace/marketplace.generated.json
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 70afd0a8..d84fd71f 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -101,12 +101,7 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Build workspace dependencies
-        run: |
-          pnpm --filter @harness-kit/shared build
-          pnpm --filter @harness-kit/core build
-          pnpm --filter @harness-kit/design-tokens build
-          pnpm --filter @harness-kit/ui build
+      - uses: ./.github/actions/prepare-desktop-frontend
 
       - name: Build desktop app
         run: |
@@ -209,3 +204,41 @@ jobs:
           git push
         env:
           GITHUB_SHA: ${{ github.sha }}
+
+  # A scheduled workflow fails where nobody is looking — this one was red for
+  # four nights before anyone noticed. Surface it as an issue instead.
+  report-failure:
+    needs: [build-cli-standalone, build-desktop, publish]
+    if: failure() && github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Open or update the nightly failure issue
+        run: |
+          # --label fails hard if the label doesn't exist yet.
+          gh label create nightly-failure \
+            --color B60205 \
+            --description "Automated: the nightly build is red" 2>/dev/null || true
+
+          RUN_URL="https://github.com/${GH_REPO}/actions/runs/${GH_RUN_ID}"
+          BODY="Nightly build failed on \`main\` (commit \`${GITHUB_SHA:0:7}\`).
+
+          Run: $RUN_URL"
+
+          EXISTING=$(gh issue list --state open --label nightly-failure \
+            --json number --jq '.[0].number')
+
+          if [[ -n "$EXISTING" ]]; then
+            gh issue comment "$EXISTING" --body "$BODY"
+          else
+            gh issue create \
+              --title "Nightly build failing" \
+              --label nightly-failure \
+              --body "$BODY"
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          GH_RUN_ID: ${{ github.run_id }}
+          GITHUB_SHA: ${{ github.sha }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c2af826d..53a7326b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -184,19 +184,7 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      # Mirrors validate.yml's desktop-build-test job — the desktop frontend
-      # imports @harness-kit/design-tokens and @harness-kit/ui directly.
-      - name: Build workspace dependencies
-        run: |
-          pnpm --filter @harness-kit/shared build
-          pnpm --filter @harness-kit/core build
-          pnpm --filter @harness-kit/design-tokens build
-          pnpm --filter @harness-kit/ui build
-
-      # The desktop Marketplace page imports a static marketplace JSON generated
-      # from git (gitignored build output) — same pattern as the website.
-      - name: Generate marketplace data
-        run: pnpm --filter @harness-kit/marketplace-data generate --strict -- --out ../../apps/desktop/src/lib/marketplace/marketplace.generated.json
+      - uses: ./.github/actions/prepare-desktop-frontend
 
       - name: Build desktop app
         run: pnpm --filter harness-kit-desktop tauri build
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 41afb858..cf537592 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -194,18 +194,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Build workspace dependencies
-        run: |
-          pnpm --filter @harness-kit/shared build
-          pnpm --filter @harness-kit/core build
-          pnpm --filter @harness-kit/design-tokens build
-          pnpm --filter @harness-kit/ui build
-
-      # The desktop Marketplace page imports a static marketplace JSON generated
-      # from git (gitignored build output) — same pattern as the website. Generate
-      # it before anything that touches the desktop frontend runs below.
-      - name: Generate marketplace data
-        run: pnpm --filter @harness-kit/marketplace-data generate -- --out ../../apps/desktop/src/lib/marketplace/marketplace.generated.json
+      - uses: ./.github/actions/prepare-desktop-frontend
+        with:
+          strict: 'false'
 
       - name: TypeScript check (desktop)
         run: pnpm --filter harness-kit-desktop exec tsc --noEmit