diff --git a/.gitea/CODEOWNERS b/.gitea/CODEOWNERS
new file mode 100644
index 00000000..7653275f
--- /dev/null
+++ b/.gitea/CODEOWNERS
@@ -0,0 +1,2 @@
+# common/ ist modulübergreifend: Änderungen brauchen Review (Auswirkungsliste im PR)
+/common/ @patrick
diff --git a/.gitea/workflows/db-tests.yml b/.gitea/workflows/db-tests.yml
index 55651a53..fd8f021c 100644
--- a/.gitea/workflows/db-tests.yml
+++ b/.gitea/workflows/db-tests.yml
@@ -4,25 +4,34 @@ on:
   pull_request:
     paths:
       - "common/**"
-      - "dms/**"
-      - "mail/**"
       - "archive/**"
       - "ai/**"
       - "connect/**"
-      - "workflow/**"
-      - "internal/**"
+      - "scripts/ci-pg-cluster.sh"
+      - ".gitea/workflows/db-tests.yml"
 
 jobs:
   db-tests:
     runs-on: nexarch-test
-    env:
-      TEST_ADMIN_DSN: ${{ secrets.TEST_ADMIN_DSN }}
-      REQUIRE_DB: "1"
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version: "1.25"
-      - name: Tests (common)
+      - name: Wegwerf-Postgres starten
+        run: scripts/ci-pg-cluster.sh start
+      - name: common
         working-directory: common
-        run: go test ./testdb/... ./migrate/... -count=1 -p 1
+        run: go test ./... -count=1 -p 1
+      - name: archive
+        working-directory: archive
+        run: go test ./... -count=1 -p 1
+      - name: ai
+        working-directory: ai
+        run: go test ./... -count=1 -p 1
+      - name: connect
+        working-directory: connect
+        run: go test ./... -count=1 -p 1
+      - name: Wegwerf-Postgres stoppen
+        if: always()
+        run: scripts/ci-pg-cluster.sh stop
diff --git a/scripts/ci-pg-cluster.sh b/scripts/ci-pg-cluster.sh
new file mode 100755
index 00000000..8de0776a
--- /dev/null
+++ b/scripts/ci-pg-cluster.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Startet/stoppt einen Wegwerf-Postgres fuer CI-DB-Tests (kein Secret, keine feste DB).
+set -euo pipefail
+
+PGBIN=${PGBIN:-/usr/lib/postgresql/17/bin}
+PREFIX=/tmp/nexarch-ci-pg.
+
+case "${1:-}" in
+start)
+  dir=$(mktemp -d "${PREFIX}XXXXXX")
+  chown postgres:postgres "$dir"
+  port=$((55000 + RANDOM % 1000))
+  while ss -ltn | grep -q ":$port "; do port=$((55000 + RANDOM % 1000)); done
+  runuser -u postgres -- "$PGBIN/initdb" -D "$dir/data" -A trust -U postgres >/dev/null
+  runuser -u postgres -- "$PGBIN/pg_ctl" -D "$dir/data" -l "$dir/log" -w \
+    -o "-p $port -c listen_addresses=127.0.0.1 -c unix_socket_directories=$dir" start >/dev/null
+  for db in tenant_a tenant_b; do
+    "$PGBIN/psql" -h 127.0.0.1 -p "$port" -U postgres -qc "create database $db"
+  done
+  base="postgres://postgres@127.0.0.1:$port"
+  {
+    echo "NEXARCH_CI_PGDIR=$dir"
+    echo "TEST_ADMIN_DSN=$base/postgres?sslmode=disable"
+    echo "TEST_TENANT_DSN=$base/tenant_a?sslmode=disable"
+    echo "TEST_TENANT_DSN_B=$base/tenant_b?sslmode=disable"
+    echo "REQUIRE_DB=1"
+  } >> "${GITHUB_ENV:-/dev/stdout}"
+  ;;
+stop)
+  dir=${NEXARCH_CI_PGDIR:-}
+  case "$dir" in "$PREFIX"*) ;; *) echo "kein CI-Cluster zu stoppen" ; exit 0 ;; esac
+  runuser -u postgres -- "$PGBIN/pg_ctl" -D "$dir/data" -m fast stop >/dev/null || true
+  rm -rf "$dir"
+  ;;
+*)
+  echo "Aufruf: $0 start|stop" >&2
+  exit 2
+  ;;
+esac