diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 28835dac..30955b26 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -109,11 +109,14 @@ build:
     # surfacing as "Cannot connect to the Docker daemon at
     # unix:///var/run/docker.sock" even though $CI_REGISTRY login already
     # succeeded (that's a separate connection, straight to the registry,
-    # not through the daemon). Disabling TLS between the two containers of
-    # the same job is standard for GitLab's Kubernetes executor — they
-    # share a pod network namespace, so plaintext here isn't exposed
-    # outside the job.
-    DOCKER_HOST: tcp://docker:2375
+    # not through the daemon). DOCKER_TLS_CERTDIR="" disables that TLS
+    # requirement. Host is `localhost`, not the service alias `docker` —
+    # this runner uses GitLab's Kubernetes executor, where every container
+    # in a job shares one pod's network namespace, unlike the Docker
+    # executor's bridge network (where the service-name alias is how you'd
+    # reach it instead). Confirmed from the job log: pod names like
+    # runner-uncqet63-project-499-concurrent-* are Kubernetes-executor pods.
+    DOCKER_HOST: tcp://localhost:2375
     DOCKER_TLS_CERTDIR: ""
   before_script:
     # $CI_REGISTRY / $CI_REGISTRY_USER / $CI_REGISTRY_PASSWORD are predefined