diff --git a/.gitea/workflows/docker-build-push.yml b/.gitea/workflows/docker-build-push.yml
index 371a952..0b4c092 100644
--- a/.gitea/workflows/docker-build-push.yml
+++ b/.gitea/workflows/docker-build-push.yml
@@ -125,6 +125,26 @@ jobs:
           echo "image_full=$IMAGE_FULL" >> "$GITHUB_OUTPUT"
           echo "tag_args=$TAG_ARGS" >> "$GITHUB_OUTPUT"
 
+      - name: Preflight registry check
+        env:
+          REGISTRY: ${{ steps.vars.outputs.registry }}
+        run: |
+          set -eu
+          echo "Probing https://$REGISTRY/v2/"
+          apk add --no-cache curl >/dev/null 2>&1 || true
+          curl -sSI "https://$REGISTRY/v2/" | awk '/HTTP\// || /WWW-Authenticate:/ || /Docker-Distribution-Api-Version:/' || true
+
+      - name: Registry auth probe (basic)
+        env:
+          REGISTRY: ${{ steps.vars.outputs.registry }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+        run: |
+          set -eu
+          apk add --no-cache curl >/dev/null 2>&1 || true
+          USER_NAME="${REGISTRY_USERNAME:-$GITHUB_ACTOR}"
+          CODE=$(curl -sS -u "$USER_NAME:${{ secrets.GITEA_TOKEN }}" -o /dev/null -w "%{http_code}" "https://$REGISTRY/v2/") || CODE=000
+          echo "Basic auth probe to https://$REGISTRY/v2/ returned HTTP $CODE"
+
       - name: Log in to Gitea Registry
         env:
           REGISTRY: ${{ steps.vars.outputs.registry }}