diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 47e223e..30b9bb3 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -33,14 +33,12 @@ jobs:
           Write-Host "Using MSBuild from $msbuildDir"
           Add-Content -Path $env:GITHUB_PATH -Value $msbuildDir
 
-      - name: Setup NuGet
-        uses: nuget/setup-nuget@v2
-
-      - name: Restore NuGet
-        run: nuget restore OutlookAddin.sln
-
-      - name: Build
-        run: msbuild OutlookAddin.sln /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
+      - name: Build (restore + compile)
+        # `msbuild /restore` runs restore and build in the same MSBuild process,
+        # which keeps the NuGet package cache + project.assets.json + assembly
+        # resolution consistent (avoids NETSDK1064 from a mismatch between a
+        # standalone `nuget restore` and the later build).
+        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
 
       - name: Test
         run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx"
@@ -68,9 +66,6 @@ jobs:
           if (-not $installPath) { throw "No VS installation with the Office workload found on this runner." }
           Add-Content -Path $env:GITHUB_PATH -Value (Join-Path $installPath 'MSBuild\Current\Bin')
 
-      - name: Setup NuGet
-        uses: nuget/setup-nuget@v2
-
       - name: Resolve mage.exe + signtool.exe paths
         id: tools
         shell: powershell
@@ -131,11 +126,8 @@ jobs:
           Remove-Item -Force $tmpPfx
           Write-Host "Cert imported."
 
-      - name: Restore NuGet
-        run: nuget restore OutlookAddin.sln
-
-      - name: Build Release
-        run: msbuild OutlookAddin.sln /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
+      - name: Build Release (restore + compile)
+        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
 
       # Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool
       # picks it by thumbprint, the service runs as LocalSystem so the runtime