diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 13fd1a779..212e06a89 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -325,35 +325,11 @@ jobs:
     name: DevHub Build Validation
     needs: detect-changes
     if: needs.detect-changes.outputs.docs == 'true'
-    runs-on:
-      group: databricks-protected-runner-group
-      labels: linux-ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Setup JFrog npm
-        uses: ./.github/actions/setup-jfrog-npm
-
-      - name: Clone DevHub
-        run: git clone --depth 1 https://github.com/databricks/devhub.git /tmp/devhub
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-
-      - name: Install DevHub dependencies
-        working-directory: /tmp/devhub
-        run: npm install
-
-      - name: Sync AppKit docs from PR branch
-        working-directory: /tmp/devhub
-        env:
-          APPKIT_REMOTE: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }}
-          APPKIT_BRANCH: ${{ github.head_ref || github.ref_name }}
-        run: node scripts/sync-appkit-docs.mjs --force
-
-      - name: Build DevHub
-        working-directory: /tmp/devhub
-        run: npm run build
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/devhub-build.yml
+    with:
+      appkit-remote: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }}
+      appkit-ref: ${{ github.head_ref || github.ref_name }}
 
diff --git a/.github/workflows/devhub-build.yml b/.github/workflows/devhub-build.yml
new file mode 100644
index 000000000..256317ddb
--- /dev/null
+++ b/.github/workflows/devhub-build.yml
@@ -0,0 +1,57 @@
+name: DevHub Build
+
+# Builds DevHub with AppKit docs synced from the given ref.
+# Called by ci.yml (per-PR) and devhub-nightly.yml.
+
+on:
+  workflow_call:
+    inputs:
+      appkit-remote:
+        description: "Git URL to sync AppKit docs from"
+        type: string
+        default: "https://github.com/databricks/appkit.git"
+      appkit-ref:
+        description: "AppKit branch/ref to sync docs from"
+        type: string
+        default: "main"
+
+permissions:
+  contents: read
+  id-token: write # required for the JFrog OIDC token exchange in setup-jfrog-npm
+
+jobs:
+  build:
+    name: Build DevHub
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup JFrog npm
+        uses: ./.github/actions/setup-jfrog-npm
+
+      - name: Clone DevHub
+        run: git clone --depth 1 https://github.com/databricks/devhub.git /tmp/devhub
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Install DevHub dependencies
+        working-directory: /tmp/devhub
+        run: pnpm install --frozen-lockfile
+
+      - name: Sync AppKit docs
+        working-directory: /tmp/devhub
+        env:
+          APPKIT_REMOTE: ${{ inputs.appkit-remote }}
+          APPKIT_BRANCH: ${{ inputs.appkit-ref }}
+        run: node scripts/sync-appkit-docs.mjs --force
+
+      - name: Build DevHub
+        working-directory: /tmp/devhub
+        run: pnpm build
diff --git a/.github/workflows/devhub-nightly.yml b/.github/workflows/devhub-nightly.yml
new file mode 100644
index 000000000..227f748f7
--- /dev/null
+++ b/.github/workflows/devhub-nightly.yml
@@ -0,0 +1,18 @@
+name: DevHub Nightly Build
+
+# Daily check that AppKit main docs still build inside DevHub, catching DevHub-side
+# breaks that land between docs PRs. Failures surface via GitHub's scheduled-failure email.
+
+on:
+  schedule:
+    - cron: "0 6 * * *" # 06:00 UTC daily
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  devhub-build:
+    # Defaults build databricks/appkit main against DevHub.
+    uses: ./.github/workflows/devhub-build.yml