diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 8ccb141..96b44cd 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -14,7 +14,6 @@ jobs:
   build:
     runs-on: docker-ready
     env:
-      DOCKER_HOST: tcp://127.0.0.1:2375
       DOCKER_BUILDKIT: "1"
     steps:
       - name: Checkout
@@ -22,6 +21,20 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Point DOCKER_HOST at this container's own gateway
+        run: |
+          set -euo pipefail
+          # 127.0.0.1 doesn't work: the job container is nested one level
+          # inside the runner pod's dind sidecar, so its own loopback isn't
+          # the sidecar's. Read the container's actual default-route gateway
+          # directly from /proc/net/route instead of relying on `ip`/`route`
+          # CLI tools being installed in the job image.
+          GATEWAY="$(awk '$2 == "00000000" {print $3}' /proc/net/route | head -1 | \
+            sed -E 's/(..)(..)(..)(..)/0x\4 0x\3 0x\2 0x\1/' | \
+            { read -r a b c d; printf '%d.%d.%d.%d' "$a" "$b" "$c" "$d"; })"
+          echo "Detected docker host gateway: $GATEWAY"
+          echo "DOCKER_HOST=tcp://$GATEWAY:2375" >> "$GITHUB_ENV"
+
       - name: Set up Docker Buildx
         run: |
           set -euo pipefail