diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d34fd0638..79dd580f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,17 +82,11 @@ jobs:
 
       - name: Install Playwright (chromium)
         run: npx playwright install --with-deps chromium
-
-      - name: Setup Supabase CLI
-        uses: supabase/setup-cli@v1
-        with:
-          version: latest
-
       - name: Boot Supabase + run two-client Realtime e2e (R1–R7)
         run: |
-          supabase start
+          npx supabase start
           ./scripts/run-e2e.sh canvas-sync-regressions.spec.ts --project=chromium --workers=2
 
       - name: Stop Supabase
         if: always()
-        run: supabase stop || true
+        run: npx supabase stop || true
diff --git a/scripts/run-e2e.sh b/scripts/run-e2e.sh
index 2911c1d1f..30bd45364 100755
--- a/scripts/run-e2e.sh
+++ b/scripts/run-e2e.sh
@@ -6,7 +6,7 @@
 set -euo pipefail
 
 # Auto-fetch keys from local Supabase if not already set
-SUPABASE_STATUS_ENV="${SUPABASE_STATUS_ENV:-$(supabase status -o env 2>&1 || true)}"
+SUPABASE_STATUS_ENV="${SUPABASE_STATUS_ENV:-$(npx supabase status -o env 2>&1 || true)}"
 
 if [ -z "${SUPABASE_SERVICE_ROLE_KEY:-}" ]; then
   # Try new-format secret key first (Supabase v2.x uses sb_secret_* instead of HS256 JWT)
@@ -27,7 +27,7 @@ if [ -z "${VITE_SUPABASE_ANON_KEY:-}" ]; then
 fi
 
 if [ -z "${SUPABASE_SERVICE_ROLE_KEY:-}" ] || [ -z "${VITE_SUPABASE_ANON_KEY:-}" ]; then
-  echo "ERROR: Could not fetch Supabase keys. Is local Supabase running? (supabase start)"
+  echo "ERROR: Could not fetch Supabase keys. Is local Supabase running? (npx supabase start)"
   exit 1
 fi
 
diff --git a/src/components/settings/tabs/AccountSettingsTab.vue b/src/components/settings/tabs/AccountSettingsTab.vue
index e709c08a5..952b6e017 100644
--- a/src/components/settings/tabs/AccountSettingsTab.vue
+++ b/src/components/settings/tabs/AccountSettingsTab.vue
@@ -342,7 +342,7 @@ const handleChangePassword = async () => {
                 class="form-input"
                 placeholder="Enter new password"
               >
-              <button class="toggle-visibility" @click="showPassword = !showPassword">
+              <button class="toggle-visibility" :aria-label="showPassword ? 'Hide password' : 'Show password'" @click="showPassword = !showPassword">
                 <Eye v-if="!showPassword" :size="16" />
                 <EyeOff v-else :size="16" />
               </button>
@@ -504,7 +504,7 @@ const handleChangePassword = async () => {
             class="form-input"
             @focus="(e) => (e.target as HTMLInputElement).select()"
           >
-          <button class="toggle-visibility" :title="localApiCopied ? 'Copied!' : 'Copy'" @click="copyLocalApiToken">
+          <button class="toggle-visibility" :title="localApiCopied ? 'Copied!' : 'Copy'" :aria-label="localApiCopied ? 'Copied!' : 'Copy local API token'" @click="copyLocalApiToken">
             <Check v-if="localApiCopied" :size="16" />
             <Copy v-else :size="16" />
           </button>