diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 9eb445f2..28835dac 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -102,6 +102,19 @@ build:
     - docker:27-dind
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "dev"'
+  variables:
+    # docker:27-dind defaults to TLS on :2376 with certs under
+    # /certs/client, which this client image never mounts — the dind
+    # service comes up fine but the docker:27-cli image can't find it,
+    # surfacing as "Cannot connect to the Docker daemon at
+    # unix:///var/run/docker.sock" even though $CI_REGISTRY login already
+    # succeeded (that's a separate connection, straight to the registry,
+    # not through the daemon). Disabling TLS between the two containers of
+    # the same job is standard for GitLab's Kubernetes executor — they
+    # share a pod network namespace, so plaintext here isn't exposed
+    # outside the job.
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
   before_script:
     # $CI_REGISTRY / $CI_REGISTRY_USER / $CI_REGISTRY_PASSWORD are predefined
     # GitLab CI variables — populated automatically now that this project's