diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e2a71612..1818d462 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -40,7 +40,11 @@ variables:
   IMAGE: $CI_REGISTRY_IMAGE
   GIT_STRATEGY: clone
   DOCKER_DRIVER: overlay2
-  DOCKER_HOST: tcp://localhost:2375    
+  # DinD service is reached at the `docker` alias (set explicitly on the
+  # service below), not localhost. TLS disabled so the daemon listens on
+  # plaintext 2375 — same pattern as the working vnc-localidp pipeline.
+  DOCKER_HOST: tcp://docker:2375
+  DOCKER_TLS_CERTDIR: ""
 
 # ---------------------------------------------------------------------------
 # verify — required check on every MR into dev. No registry, no cluster.
@@ -69,7 +73,8 @@ build:
   stage: build
   image: docker:28.4.0
   services:
-    - docker:28.4.0-dind
+    - name: docker:28.4.0-dind
+      alias: docker
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "dev"'
   before_script: