diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index a274b96..4aa5290 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -107,18 +107,20 @@ jobs:
             --agents 1 \
             --k3s-arg "--disable=traefik@server:0" \
             --wait
+          # Gitea runners execute inside a Docker container (DinD). The host
+          # loopback (127.0.0.1) is unreachable from inside the runner container,
+          # so we patch the kubeconfig to use the k3d server container's
+          # Docker-network IP and connect directly on port 6443.
+          SERVER_IP=$(docker inspect k3d-tofu-test-server-0 \
+            --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')
           k3d kubeconfig get tofu-test \
-            | sed 's|https://0\.0\.0\.0:|https://127.0.0.1:|g' \
+            | sed "s|https://0\.0\.0\.0:[0-9]*|https://${SERVER_IP}:6443|g" \
+            | sed "s|https://127\.0\.0\.1:[0-9]*|https://${SERVER_IP}:6443|g" \
             > /tmp/test-kubeconfig
           chmod 600 /tmp/test-kubeconfig
 
       - name: Install Traefik CRDs
         run: |
-          # Wait for API server to accept connections before applying CRDs
-          for i in $(seq 1 20); do
-            kubectl --kubeconfig /tmp/test-kubeconfig get nodes >/dev/null 2>&1 && break
-            echo "Waiting for API server... ($i/20)"; sleep 3
-          done
           kubectl --kubeconfig /tmp/test-kubeconfig apply --validate=false \
             -f https://raw.githubusercontent.com/traefik/traefik/v2.11/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
           kubectl --kubeconfig /tmp/test-kubeconfig wait \
diff --git a/.gitlab/workflows/test.gitlab-ci.yml b/.gitlab/workflows/test.gitlab-ci.yml
index 4bae4a6..6294dcd 100644
--- a/.gitlab/workflows/test.gitlab-ci.yml
+++ b/.gitlab/workflows/test.gitlab-ci.yml
@@ -91,14 +91,19 @@ integration-k8s:
         --agents 1 \
         --k3s-arg "--disable=traefik@server:0" \
         --wait
-      k3d kubeconfig get tofu-test > /tmp/test-kubeconfig
+      # GitLab CI runners execute inside a Docker container (DinD). The host
+      # loopback (127.0.0.1) is unreachable from inside the runner container,
+      # so patch the kubeconfig to use the k3d server container's
+      # Docker-network IP and connect directly on port 6443.
+      SERVER_IP=$(docker inspect k3d-tofu-test-server-0 \
+        --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')
+      k3d kubeconfig get tofu-test \
+        | sed "s|https://0\.0\.0\.0:[0-9]*|https://${SERVER_IP}:6443|g" \
+        | sed "s|https://127\.0\.0\.1:[0-9]*|https://${SERVER_IP}:6443|g" \
+        > /tmp/test-kubeconfig
       chmod 600 /tmp/test-kubeconfig
     - |
       echo "── Installing Traefik CRDs ──"
-      for i in $(seq 1 20); do
-        kubectl --kubeconfig /tmp/test-kubeconfig get nodes >/dev/null 2>&1 && break
-        echo "Waiting for API server... ($i/20)"; sleep 3
-      done
       kubectl --kubeconfig /tmp/test-kubeconfig apply --validate=false \
         -f https://raw.githubusercontent.com/traefik/traefik/v2.11/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
       kubectl --kubeconfig /tmp/test-kubeconfig wait \