diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 4aa5290..a1c78e8 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -107,12 +107,13 @@ jobs:
             --agents 1 \
             --k3s-arg "--disable=traefik@server:0" \
             --wait
-          # Gitea runners execute inside a Docker container (DinD). The host
-          # loopback (127.0.0.1) is unreachable from inside the runner container,
-          # so we patch the kubeconfig to use the k3d server container's
-          # Docker-network IP and connect directly on port 6443.
+          # Gitea runners run inside a Docker container. k3d creates its own
+          # bridge network (k3d-tofu-test); the runner isn't on it, so we
+          # join the runner container to that network, then patch the kubeconfig
+          # to use the server container's IP on that network directly (port 6443).
+          docker network connect k3d-tofu-test "$(hostname)"
           SERVER_IP=$(docker inspect k3d-tofu-test-server-0 \
-            --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')
+            --format '{{(index .NetworkSettings.Networks "k3d-tofu-test").IPAddress}}')
           k3d kubeconfig get tofu-test \
             | sed "s|https://0\.0\.0\.0:[0-9]*|https://${SERVER_IP}:6443|g" \
             | sed "s|https://127\.0\.0\.1:[0-9]*|https://${SERVER_IP}:6443|g" \
diff --git a/.gitlab/workflows/test.gitlab-ci.yml b/.gitlab/workflows/test.gitlab-ci.yml
index 6294dcd..d948443 100644
--- a/.gitlab/workflows/test.gitlab-ci.yml
+++ b/.gitlab/workflows/test.gitlab-ci.yml
@@ -91,12 +91,13 @@ integration-k8s:
         --agents 1 \
         --k3s-arg "--disable=traefik@server:0" \
         --wait
-      # GitLab CI runners execute inside a Docker container (DinD). The host
-      # loopback (127.0.0.1) is unreachable from inside the runner container,
-      # so patch the kubeconfig to use the k3d server container's
-      # Docker-network IP and connect directly on port 6443.
+      # GitLab CI runners run inside a Docker container. k3d creates its own
+      # bridge network (k3d-tofu-test); the runner isn't on it, so we
+      # join the runner container to that network, then patch the kubeconfig
+      # to use the server container's IP on that network directly (port 6443).
+      docker network connect k3d-tofu-test "$(hostname)"
       SERVER_IP=$(docker inspect k3d-tofu-test-server-0 \
-        --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')
+        --format '{{(index .NetworkSettings.Networks "k3d-tofu-test").IPAddress}}')
       k3d kubeconfig get tofu-test \
         | sed "s|https://0\.0\.0\.0:[0-9]*|https://${SERVER_IP}:6443|g" \
         | sed "s|https://127\.0\.0\.1:[0-9]*|https://${SERVER_IP}:6443|g" \