diff --git a/package.json b/package.json
index 8c22e04f..34f36656 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
     "postinstall": "nuxt prepare",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "typecheck": "wrangler types --check --config wrangler.jsonc --env-file .dev.vars.example && nuxt typecheck",
+    "typecheck": "wrangler types --check --config wrangler.jsonc --env-file .dev.vars.example && nuxt typecheck && pnpm --filter @skilld/artifact-signer-worker typecheck",
     "test": "vitest",
     "test:run": "vitest run",
     "test:e2e": "pnpm build:test && playwright test",
diff --git a/shared/server/github-app-credential.ts b/shared/server/github-app-credential.ts
index b8e690e4..7ddaa73b 100644
--- a/shared/server/github-app-credential.ts
+++ b/shared/server/github-app-credential.ts
@@ -574,7 +574,7 @@ async function readBoundedJson(response: Response, maximumBytes: number): Promis
     bytes.set(chunk, offset)
     offset += chunk.byteLength
   }
-  const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+  const text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes)
   // A JSON.parse error quotes the start of the body, which holds the token.
   try {
     return JSON.parse(text) as unknown