diff --git a/src/auth.config.ts b/src/auth.config.ts
index 31de3f0..00ddea1 100644
--- a/src/auth.config.ts
+++ b/src/auth.config.ts
@@ -29,10 +29,10 @@ export function getNeonAuthConfig(): NeonAuthBaseConfig {
   const baseUrl = process.env.NEON_AUTH_BASE_URL || "";
   const cookieSecret = process.env.NEON_AUTH_COOKIE_SECRET || "";
 
-  // Detect CI build context: DATABASE_URL is set (Build step), NEON_AUTH_BASE_URL is empty.
-  // In this case, return a placeholder so `next build` succeeds — auth will be validated
+  // Detect CI build context: DATABASE_URL is set (Build step), but one or both Neon Auth
+  // vars are empty. Return a placeholder so `next build` succeeds — auth is validated
   // at runtime when actually needed.
-  const isCIBuild = !!process.env.DATABASE_URL && !baseUrl;
+  const isCIBuild = !!process.env.DATABASE_URL && (!baseUrl || !cookieSecret);
 
   if (!baseUrl || baseUrl === "placeholder") {
     if (isCIBuild) {
@@ -64,8 +64,8 @@ export function getNeonAuthConfig(): NeonAuthBaseConfig {
  * Use this for middleware that should gracefully degrade if auth is not set up.
  */
 export function getNeonAuthConfigOptional(): NeonAuthBaseConfig | null {
-  const baseUrl = process.env.NEON_AUTH_BASE_URL;
-  const cookieSecret = process.env.NEON_AUTH_COOKIE_SECRET;
+  const baseUrl = process.env.NEON_AUTH_BASE_URL || "";
+  const cookieSecret = process.env.NEON_AUTH_COOKIE_SECRET || "";
 
   if (!baseUrl || !cookieSecret || cookieSecret.length < 32) {
     return null;