diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index fff150b..c046de9 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -14,7 +14,12 @@ jobs:
   build:
     runs-on: docker-ready
     env:
-      DOCKER_HOST: tcp://127.0.0.1:2375
+      # 127.0.0.1 doesn't work here: the job container is nested one level
+      # inside the runner pod's dind sidecar, so its own loopback isn't the
+      # sidecar's. host.docker.internal (mapped via --add-host in the
+      # runner's container.options) reaches back to the dind engine that
+      # actually spawned this container.
+      DOCKER_HOST: tcp://host.docker.internal:2375
       DOCKER_BUILDKIT: "1"
     steps:
       - name: Checkout