diff --git a/.gitea/workflows/cicd.yaml b/.gitea/workflows/cicd.yaml
index 13aa4bf..61518bb 100644
--- a/.gitea/workflows/cicd.yaml
+++ b/.gitea/workflows/cicd.yaml
@@ -22,6 +22,8 @@ env:
   GITEA_REGISTRY: kankali.darkhelm.lan:3001
   GITEA_REGISTRY_IP: 10.18.75.2
   GITEA_REGISTRY_HOST: kankali.darkhelm.lan
+  GITEA_REGISTRY_AUTH_HOST: kankali.darkhelm.lan
+  GITEA_REGISTRY_AUTH_FALLBACK_HOST: dogar.darkhelm.org
   CI_PRUNE_AT_JOB_START: "true"
   CI_PRUNE_THRESHOLD_PERCENT: "90"
 
@@ -155,12 +157,19 @@ jobs:
               echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
             fi
 
+            if [ -n "${GITEA_REGISTRY_AUTH_FALLBACK_HOST:-}" ] && ! grep -q "${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" /etc/hosts; then
+              echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" >> /etc/hosts
+            fi
+
             headers_file="$(mktemp)"
             if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
               realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
               if [ -n "${realm_url}" ]; then
                 realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
                 if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
+                  if [ -n "${GITEA_REGISTRY_AUTH_HOST:-}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_AUTH_HOST}" ]; then
+                    echo "Registry advertised auth realm host '${realm_host}' (expected '${GITEA_REGISTRY_AUTH_HOST}'). Applying host pin for reliability."
+                  fi
                   if ! grep -q "${realm_host}" /etc/hosts; then
                     echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
                     echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"
@@ -267,12 +276,19 @@ jobs:
               echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
             fi
 
+            if [ -n "${GITEA_REGISTRY_AUTH_FALLBACK_HOST:-}" ] && ! grep -q "${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" /etc/hosts; then
+              echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" >> /etc/hosts
+            fi
+
             headers_file="$(mktemp)"
             if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
               realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
               if [ -n "${realm_url}" ]; then
                 realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
                 if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
+                  if [ -n "${GITEA_REGISTRY_AUTH_HOST:-}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_AUTH_HOST}" ]; then
+                    echo "Registry advertised auth realm host '${realm_host}' (expected '${GITEA_REGISTRY_AUTH_HOST}'). Applying host pin for reliability."
+                  fi
                   if ! grep -q "${realm_host}" /etc/hosts; then
                     echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
                     echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"
@@ -453,12 +469,19 @@ jobs:
               echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
             fi
 
+            if [ -n "${GITEA_REGISTRY_AUTH_FALLBACK_HOST:-}" ] && ! grep -q "${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" /etc/hosts; then
+              echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" >> /etc/hosts
+            fi
+
             headers_file="$(mktemp)"
             if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
               realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
               if [ -n "${realm_url}" ]; then
                 realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
                 if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
+                  if [ -n "${GITEA_REGISTRY_AUTH_HOST:-}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_AUTH_HOST}" ]; then
+                    echo "Registry advertised auth realm host '${realm_host}' (expected '${GITEA_REGISTRY_AUTH_HOST}'). Applying host pin for reliability."
+                  fi
                   if ! grep -q "${realm_host}" /etc/hosts; then
                     echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
                     echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"
@@ -615,12 +638,19 @@ jobs:
               echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
             fi
 
+            if [ -n "${GITEA_REGISTRY_AUTH_FALLBACK_HOST:-}" ] && ! grep -q "${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" /etc/hosts; then
+              echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" >> /etc/hosts
+            fi
+
             headers_file="$(mktemp)"
             if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
               realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
               if [ -n "${realm_url}" ]; then
                 realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
                 if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
+                  if [ -n "${GITEA_REGISTRY_AUTH_HOST:-}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_AUTH_HOST}" ]; then
+                    echo "Registry advertised auth realm host '${realm_host}' (expected '${GITEA_REGISTRY_AUTH_HOST}'). Applying host pin for reliability."
+                  fi
                   if ! grep -q "${realm_host}" /etc/hosts; then
                     echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
                     echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"