diff --git a/.forgejo/workflows/test.yaml b/.forgejo/workflows/test.yaml
index 6fbb70e..4f8a5fa 100644
--- a/.forgejo/workflows/test.yaml
+++ b/.forgejo/workflows/test.yaml
@@ -37,7 +37,7 @@ jobs:
           fi
 
           run=false
-          if echo "$CHANGED_FILES" | grep -Eq '^(crates/db/|Cargo\.toml|Cargo\.lock|\.forgejo/workflows/test\.yaml)'; then
+          if echo "$CHANGED_FILES" | grep -Eq '^(crates/db/|Cargo\.toml|Cargo\.lock|Dockerfile\.test|\.forgejo/workflows/test\.yaml)'; then
             run=true
           fi
           echo "run=$run" >> "$GITHUB_OUTPUT"
@@ -45,17 +45,43 @@ jobs:
             echo "No changes relevant to crates/db - skipping integration tests."
           fi
 
-      - name: Debug echo after check
-        run: echo "check.outputs.run was ${{ steps.check.outputs.run }}"
-
-      - name: Debug conditional step
+      - name: Verify TEST_DATABASE_URL is configured
         if: steps.check.outputs.run == 'true'
-        run: echo "conditional step ran"
+        run: |
+          test -n "${TEST_DATABASE_URL:-}" || { echo "TEST_DATABASE_URL secret is not set - see docs/LIVE_SERVER_RUNBOOK.md step 6"; exit 1; }
 
-      - name: Debug apt-get
+      - name: Point DOCKER_HOST at this container's own gateway
         if: steps.check.outputs.run == 'true'
         run: |
           set -euo pipefail
-          apt-get update -qq
-          apt-get install -y -qq build-essential pkg-config
-          echo "apt-get done, cc: $(which cc)"
+          # Same trick build.yaml uses: this job container is nested one level
+          # inside the runner pod's dind sidecar, so its own loopback isn't the
+          # sidecar's - read the container's actual default-route gateway
+          # directly from /proc/net/route instead of relying on `ip`/`route`.
+          GATEWAY="$(awk '$2 == "00000000" {print $3}' /proc/net/route | head -1 | \
+            sed -E 's/(..)(..)(..)(..)/0x\4 0x\3 0x\2 0x\1/' | \
+            { read -r a b c d; printf '%d.%d.%d.%d' "$a" "$b" "$c" "$d"; })"
+          echo "Detected docker host gateway: $GATEWAY"
+          echo "DOCKER_HOST=tcp://$GATEWAY:2375" >> "$GITHUB_ENV"
+
+      - name: Set up Docker Buildx
+        if: steps.check.outputs.run == 'true'
+        run: |
+          set -euo pipefail
+          docker version
+          docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
+          docker buildx inspect --bootstrap
+
+      - name: Run ai_credits integration tests
+        if: steps.check.outputs.run == 'true'
+        run: |
+          set -euo pipefail
+          # Build context transfer (not a bind mount) is what makes this work
+          # despite the nested dind setup - same reason build.yaml uses
+          # buildx rather than plain `docker run -v`. The Dockerfile's RUN
+          # step is the actual test; a non-zero exit fails this build (and
+          # this workflow step) the same way a failed `cargo test` would.
+          docker buildx build \
+            --secret id=test_db_url,env=TEST_DATABASE_URL \
+            -f Dockerfile.test \
+            .
diff --git a/Dockerfile.test b/Dockerfile.test
new file mode 100644
index 0000000..89c37c9
--- /dev/null
+++ b/Dockerfile.test
@@ -0,0 +1,13 @@
+# Runs crates/db's Postgres-backed integration tests as a build step.
+# Not published anywhere - build.yaml's DOCKER_HOST/buildx setup builds this
+# ad-hoc and discards the image; only whether the RUN step exits 0 matters.
+# TEST_DATABASE_URL is passed as a buildx secret (not a build-arg) so it
+# never lands in the image's layer history/cache metadata.
+FROM rust:1-bookworm
+
+WORKDIR /workspace
+COPY . .
+
+RUN --mount=type=secret,id=test_db_url,required=true \
+    export TEST_DATABASE_URL="$(cat /run/secrets/test_db_url)" && \
+    cargo test -p db --test ai_credits --test ai_credits_reaper -- --test-threads=1