diff --git a/.gitea/workflows/service-networking-probe.yml b/.gitea/workflows/service-networking-probe.yml
new file mode 100644
index 0000000..6d9ada8
--- /dev/null
+++ b/.gitea/workflows/service-networking-probe.yml
@@ -0,0 +1,38 @@
+# One-off experiment: how are service containers reached on THIS runner?
+#
+# GitHub-hosted runners port-map services to localhost. Gitea Actions runs the
+# job inside a container, so `localhost` is the job itself and services are
+# reached by their service NAME. Several migrated workflows hardcode
+# localhost:5432 — before rewriting any of them, prove which form actually
+# works here instead of assuming.
+name: service-networking-probe
+
+on:
+  workflow_dispatch:
+
+jobs:
+  probe:
+    runs-on: veron-1
+    timeout-minutes: 6
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: probe
+          POSTGRES_PASSWORD: probe
+          POSTGRES_DB: probe
+        options: >-
+          --health-cmd "pg_isready -U probe"
+          --health-interval 5s
+          --health-retries 10
+    steps:
+      - name: which hostname reaches the service?
+        run: |
+          apt-get install -y postgresql-client >/dev/null 2>&1 || true
+          for host in localhost 127.0.0.1 postgres; do
+            if PGPASSWORD=probe psql -h "$host" -U probe -d probe -c 'SELECT 1' >/dev/null 2>&1; then
+              echo "RESULT $host = REACHABLE"
+            else
+              echo "RESULT $host = unreachable"
+            fi
+          done