diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4fdc3dc..fbafc46 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -395,11 +395,11 @@ jobs:
 
           git push -u origin "chore/update-image-tags-${TAG}"
 
-          # Create PR with auto-merge
+          # Create PR and merge immediately (no required checks on groombook/infra)
           PR_URL=$(gh pr create \
             --repo groombook/infra \
             --base main \
             --head "chore/update-image-tags-${TAG}" \
             --title "chore: deploy ${TAG} to dev" \
             --body "[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge")
-          gh pr merge "$PR_URL" --auto --merge
+          gh pr merge "$PR_URL" --merge
diff --git a/apps/web/src/App.tsx b/apps/web/src/App.tsx
index a8f7b2a..b0ac1c7 100644
--- a/apps/web/src/App.tsx
+++ b/apps/web/src/App.tsx
@@ -262,6 +262,9 @@ export function App() {
     return <Navigate to="/setup" replace />;
   }
 
+  // Don't render portal chrome at /login — DevLoginSelector is shown instead
+  const showCustomerPortal = !location.pathname.startsWith("/admin") && location.pathname !== "/login";
+
   return (
     <BrandingProvider>
       {location.pathname.startsWith("/admin") ? (
@@ -271,12 +274,12 @@ export function App() {
           </Routes>
           {authDisabled && <DevSessionIndicator />}
         </>
-      ) : (
+      ) : showCustomerPortal ? (
         <>
           <CustomerPortal />
           {authDisabled && <DevSessionIndicator />}
         </>
-      )}
+      ) : null}
     </BrandingProvider>
   );
 }