diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index b1e9b5b..7edc474 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -178,6 +178,13 @@ jobs:
           # Ensure token endpoint host resolves to internal network IP from runner.
           # Registry auth flow may redirect to ${GITEA_HOST} even when pushing to REGISTRY_HOST.
           echo "10.10.0.10 ${GITEA_HOST}" >> /etc/hosts
+          getent hosts "${GITEA_HOST}" || true
+
+          # Some runners have outbound proxy env configured; force direct access
+          # to internal registry/gitea hosts for auth flow.
+          unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY all_proxy ALL_PROXY
+          export NO_PROXY="${NO_PROXY:-},10.10.0.10,${GITEA_HOST}"
+          export no_proxy="${no_proxy:-},10.10.0.10,${GITEA_HOST}"
 
           echo "${REGISTRY_PASSWORD}" | ./crane auth login --insecure "${REGISTRY_HOST}" -u "${REGISTRY_USER}" --password-stdin