diff --git a/.ci/compile.sh b/.ci/compile.sh
index 9be8ba741..1db0cacd1 100755
--- a/.ci/compile.sh
+++ b/.ci/compile.sh
@@ -175,9 +175,9 @@ fi
 if [[ $MAKE_SANITIZE ]]; then
   flags+=("-DENABLE_SANITIZERS=ON")
 else
-  # The release-package step re-runs cmake in the same build dir, so an
-  # ENABLE_SANITIZERS=ON left over from the debug step would otherwise leak
-  # into the shipped binaries (libasan/libubsan Depends in the DEB).
+  # Every leg states the flag explicitly rather than relying on the CMake
+  # default, so a build directory reused from a sanitized configuration can
+  # never leak libasan/libubsan into a shipped binary.
   flags+=("-DENABLE_SANITIZERS=OFF")
 fi
 if [[ $MAKE_COVERAGE ]]; then
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 16610d872..9f2d679fa 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -187,10 +187,21 @@ jobs:
             version: 26.04
 
             package: DEB
+            test: skip    # The sanitizer leg below runs this distro's suite
 
-            # The one leg that runs the suite under AddressSanitizer and
-            # UndefinedBehaviorSanitizer. Debian 13 and Fedora 44 keep covering the
-            # uninstrumented suite, so nothing is lost by instrumenting this one.
+          # The one leg that runs the suite under AddressSanitizer and
+          # UndefinedBehaviorSanitizer. Debian 13 and Fedora 44 keep covering the
+          # uninstrumented suite, so nothing is lost by instrumenting this one.
+          #
+          # It packages nothing. A sanitized Debug build is not something to ship, and
+          # carrying the package build here meant 18 minutes of Release compile queued
+          # behind the instrumented one in a single job. The leg above publishes this
+          # distro's DEB.
+          - distro: Ubuntu
+            version: 26.04
+            variant: sanitize    # separate image and ccache, same distro
+
+            package: skip
             sanitize: yes
 
           - distro: Ubuntu
@@ -202,7 +213,7 @@ jobs:
             # sanitizer leg because the two instruments answer different questions: the
             # sanitizer leg reports what the run did wrong, the coverage leg reports what the
             # run never touched at all. Combining them would also slow both down. Packaging is
-            # skipped because the leg above already publishes the DEB for this distro.
+            # skipped because the plain Ubuntu 26.04 leg publishes the DEB for this distro.
             coverage: yes
             package: skip