diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 23167d7..5e4736c 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -110,10 +110,15 @@ jobs:
           docker compose --env-file "$ENV_FILE" up -d
 
       - name: Wait for the API to become healthy
+        # NOT localhost: this step runs inside the runner's own ephemeral DooD job container,
+        # which is a separate container from `caddy` — `caddy`'s -p 8090:80 publishes onto the
+        # real host's network namespace, not this job container's loopback, so `localhost:8090`
+        # here would just be connection-refused regardless of whether the deploy actually
+        # succeeded. Hit the same host IP deploy/.env.example's VELODROME_PUBLIC_URL already uses.
         run: |
           set -euo pipefail
           for i in $(seq 1 10); do
-            if curl -fsS http://localhost:8090/api/v1/healthz; then
+            if curl -fsS http://192.168.0.103:8090/api/v1/healthz; then
               echo "Healthy."
               exit 0
             fi