diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index fee801b..4aeecf5 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -59,6 +59,21 @@ jobs:
         run: |
           echo -e "Host gitea\n  HostName 100.79.174.108\n  Port 222\n  StrictHostKeyChecking no" >> /etc/ssh/ssh_config
 
+      - name: Diagnose git remote connectivity
+        run: |
+          echo "--- relevant env vars ---"
+          env | grep -Ei '^(GITHUB_|CI_|GITEA_)' || true
+          echo "--- /etc/ssh/ssh_config ---"
+          cat /etc/ssh/ssh_config
+          echo "--- raw TCP reachability to 100.79.174.108:222 ---"
+          timeout 5 bash -c 'cat < /dev/null > /dev/tcp/100.79.174.108/222' && echo "TCP 222: OPEN" || echo "TCP 222: CLOSED/UNREACHABLE"
+          echo "--- ls-remote against candidate hosts (verbose ssh) ---"
+          for url in "git@gitea:danchie/tekton.git" "git@git.klud.top:danchie/tekton.git" "ssh://git@100.79.174.108:222/danchie/tekton.git"; do
+            echo "=== trying $url ==="
+            GIT_SSH_COMMAND="ssh -vvv -o StrictHostKeyChecking=no -o ConnectTimeout=8" git ls-remote "$url" 2>&1 | tail -40
+            echo "exit code: $?"
+          done
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with: