diff --git a/.gitea/workflows/cicd.yaml b/.gitea/workflows/cicd.yaml
index 9354252..7ecfa6f 100644
--- a/.gitea/workflows/cicd.yaml
+++ b/.gitea/workflows/cicd.yaml
@@ -148,6 +148,28 @@ jobs:
           FORCE_REBUILD: ${{ github.event.inputs.force_rebuild_base }}
         run: |
           set -euo pipefail
+
+          ensure_registry_auth_realm_host() {
+            if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
+              echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
+            fi
+
+            headers_file="$(mktemp)"
+            if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
+              realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
+              if [ -n "${realm_url}"; then
+                realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
+                if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
+                  if ! grep -q "${realm_host}" /etc/hosts; then
+                    echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
+                    echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"
+                  fi
+                fi
+              fi
+            fi
+            rm -f "${headers_file}"
+          }
+
           BASE_HASH=$(./scripts/compute-cicd-base-hash.sh)
           BASE_REF_HASH="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"
           BASE_REF_LATEST="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:latest"
@@ -160,6 +182,8 @@ jobs:
             echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
           fi
 
+          ensure_registry_auth_realm_host
+
           echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin >/dev/null
 
           if [ "${FORCE_REBUILD:-false}" = "true" ]; then