diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 9f900c7..bc15da4 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -14,7 +14,9 @@ jobs:
 
     services:
       db:
-        image: mysql:8.0
+        # Fully qualified, matching docker/dev/docker-compose.yml: the runner is
+        # podman-backed and a bare name depends on unqualified-search-registries.
+        image: docker.io/library/mysql:8.0
         env:
           MYSQL_DATABASE: testing
           MYSQL_USER: incr_user
@@ -37,17 +39,17 @@ jobs:
       - name: Prepare environment
         run: cp .env.testing .env
 
-      # Temporary: MySQL is unreachable at db:3306 under the prebuilt image,
-      # though the identical service block worked on catthehacker/ubuntu.
-      - name: Diagnose service networking
+      # Temporary: db resolves but refuses :3306. Capture what the service
+      # container is actually doing before assuming a cause.
+      - name: Probe the db service
         continue-on-error: true
         run: |
-          echo "--- /etc/hosts ---";       cat /etc/hosts || true
-          echo "--- /etc/resolv.conf ---"; cat /etc/resolv.conf || true
-          echo "--- php resolves db ---";  php -r 'var_dump(gethostbyname("db"));' || true
-          echo "--- php connect ---";      php -r '$e=null;$f=@fsockopen("db",3306,$n,$e,3);echo $f?"open\n":"fail: $e\n";' || true
-          echo "--- hostname/ip ---";      hostname -i 2>/dev/null || true
-          echo "--- env ---";              env | sort | grep -iE "host|service|port" || true
+          echo "--- ports responding on db ---"
+          for p in 3306 33060 80; do
+            php -r "\$f=@fsockopen('db',$p,\$n,\$e,2); echo '$p: '.(\$f?'open':\$e).PHP_EOL;"
+          done
+          echo "--- can we reach ourselves? (sanity) ---"
+          php -r '$f=@fsockopen("127.0.0.1",1,$n,$e,1); echo "localhost:1 -> $e".PHP_EOL;'
 
       - name: Wait for MySQL
         run: |