diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index afe8d42..b66804e 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -395,15 +395,25 @@ jobs:
           ARMATURE_ADMIN_EMAIL: admin@test.local
         run: docker compose up -d
 
+      # In DinD (Gitea runner pods), port-mapped localhost doesn't reach
+      # the compose container.  Resolve the container IP on its Docker
+      # network so curl / Playwright can connect directly on port 80.
+      - name: Resolve container IP
+        id: container-ip
+        run: |
+          IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' armature)
+          echo "SERVER_URL=http://${IP}:80" >> "$GITHUB_OUTPUT"
+          echo "Resolved container IP → ${IP}"
+
       - name: Wait for healthy
-        run: ./ci/wait-for-healthy.sh http://localhost:3000
+        run: ./ci/wait-for-healthy.sh ${{ steps.container-ip.outputs.SERVER_URL }}
 
       - name: Install Playwright
         run: npx playwright install --with-deps chromium
 
       - name: Run surface tests
         env:
-          SERVER_URL: http://localhost:3000
+          SERVER_URL: ${{ steps.container-ip.outputs.SERVER_URL }}
           ADMIN_USER: admin
           ADMIN_PASS: admin
         run: ./ci/run-surface-tests.sh
diff --git a/ROADMAP.md b/ROADMAP.md
index 25895b4..e80d9cd 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -150,6 +150,7 @@ Design doc: `docs/DESIGN-surface-runners.md`
 | Renderer runner | done | `requires: ["mermaid-renderer"]`. 1 suite (contract), 4 tests. |
 | Runner result API | done | `POST/GET /api/v1/admin/test-runners/results`. In-memory store, 4 Go tests. |
 | CI integration | done | `test-runners` stage in Gitea CI. Playwright driver, `wait-for-healthy.sh`. |
+| CI DinD networking fix | done | Resolve container IP via `docker inspect` — DinD port mapping doesn't expose to runner localhost. |
 
 ### v0.7.3 — Extension Shell Migration + Headless E2E