diff --git a/.gitea/workflows/prod-tag-deploy.yml b/.gitea/workflows/prod-tag-deploy.yml
index 5b0a80e..b74a988 100644
--- a/.gitea/workflows/prod-tag-deploy.yml
+++ b/.gitea/workflows/prod-tag-deploy.yml
@@ -107,7 +107,7 @@ jobs:
           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
           $extra = '${{ vars.NODE_IMAGE_SOURCE }}'.Trim()
           if ($extra -like '*NODE_IMAGE_SOURCE*') { $extra = '' }
-          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix -ExtraSources $extra
+          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix "$prefix" -ExtraSources "$extra"
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push backend (tag only, not :latest)
diff --git a/.gitea/workflows/registry-build-deploy.yml b/.gitea/workflows/registry-build-deploy.yml
index aa9066e..5372837 100644
--- a/.gitea/workflows/registry-build-deploy.yml
+++ b/.gitea/workflows/registry-build-deploy.yml
@@ -92,7 +92,7 @@ jobs:
           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
           $extra = '${{ vars.NODE_IMAGE_SOURCE }}'.Trim()
           if ($extra -like '*NODE_IMAGE_SOURCE*') { $extra = '' }
-          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix -ExtraSources $extra
+          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix "$prefix" -ExtraSources "$extra"
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push backend
diff --git a/infrastructure/scripts/ci-resolve-node-image.ps1 b/infrastructure/scripts/ci-resolve-node-image.ps1
index 901f805..64b836f 100644
--- a/infrastructure/scripts/ci-resolve-node-image.ps1
+++ b/infrastructure/scripts/ci-resolve-node-image.ps1
@@ -5,6 +5,7 @@ param(
   [Parameter(Mandatory = $true)][string]$RegistryPrefix,
   [string]$OutFile = '.ci-node-image',
   [string]$HubImage = 'node:20-alpine',
+  [AllowEmptyString()]
   [string]$ExtraSources = ''
 )