diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 277cf5a..9760051 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -15,25 +15,45 @@ jobs:
       - name: Checkout
         uses: https://gitea.nikitapozd.dev/actions/checkout@v6
 
-      - name: Network smoke test (with tools)
+      - name: Bootstrap network tools
         run: |
             set -eux
-            apk add --no-cache bind-tools wget ca-certificates
-            ip link | sed -n '1,80p'
-            echo "--- resolv.conf ---"
-            cat /etc/resolv.conf || true
-            echo "--- DNS ---"
-            nslookup dl-cdn.alpinelinux.org || true
-            echo "--- download APKINDEX (10s) ---"
-            wget -S -O /dev/null --timeout=10 --tries=1 \
-            https://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz
+            # wget/curl/ca-certificates + dns tools
+            apk add --no-cache ca-certificates wget curl jq bind-tools busybox-extras
+            update-ca-certificates || true
 
-      - name: Install tools (curl, jq) with verbose
+      - name: Network smoke test (verbose)
         run: |
-            set -eux
-            export APK_PROGRESS=plain
-            apk update -v --no-progress
-            apk add -v --no-cache curl jq
+                set -eux
+                echo "=== IP / route ==="
+                ip addr
+                ip route
+                echo "=== resolv.conf ==="
+                cat /etc/resolv.conf || true
+                
+                echo "=== DNS (A/AAAA) ==="
+                nslookup -type=A dl-cdn.alpinelinux.org || true
+                nslookup -type=AAAA dl-cdn.alpinelinux.org || true
+                
+                echo "=== TCP 443 check ==="
+                # busybox-extras дает nc
+                nc -vz dl-cdn.alpinelinux.org 443 || true
+                
+                echo "=== HTTPS HEAD via curl (IPv4 forced) ==="
+                curl -4 -vI --max-time 10 https://dl-cdn.alpinelinux.org/ || true
+                
+                echo "=== APKINDEX download via wget (IPv4 forced, debug) ==="
+                # важное: именно APKINDEX, как в apk
+                wget -4 --debug -S -O /dev/null --timeout=10 --tries=1 \
+                  https://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz
+
+      - name: APK update/add (verbose)
+        run: |
+                set -eux
+                export APK_PROGRESS=plain
+                # если тут зависнет — значит проблема точно на fetch layer
+                apk update -v --no-progress
+                apk add -v --no-cache curl jq
 
       - name: Get Keycloak access token from Gitea secrets
         env: