diff --git a/apps/wave-1/gitea-actions.yaml b/apps/wave-1/gitea-actions.yaml
index 4447d82..18da371 100644
--- a/apps/wave-1/gitea-actions.yaml
+++ b/apps/wave-1/gitea-actions.yaml
@@ -106,8 +106,14 @@ spec:
           # Wait for the DinD sidecar to publish its TLS client certs into the shared
           # emptyDir before starting the daemon — act_runner reads /certs/client/ca.pem at
           # startup and hard-exits if it is missing (a startup race against the sidecar).
-          # Then exec the image's normal entrypoint (/sbin/tini -- /opt/act/run.sh), which
-          # registers-from-env on first boot and runs `act_runner daemon`.
+          # The cert FILE appearing is necessary but NOT sufficient: dockerd writes the
+          # certs and only THEN begins accepting TLS connections on :2376, so a runner that
+          # proceeds on the file alone still hard-exits with "cannot ping the docker daemon
+          # at tcp://localhost:2376" (observed crashlooping on node bounces / slow containerd
+          # starts). So after the certs appear, also wait until the daemon actually ACCEPTS
+          # a TCP connection on 2376 before exec'ing the image's normal entrypoint
+          # (/sbin/tini -- /opt/act/run.sh), which registers-from-env on first boot and runs
+          # `act_runner daemon`.
           command:
             - /bin/sh
             - -c
@@ -118,6 +124,12 @@ spec:
                 [ "$i" -ge 60 ] && { echo "dind certs never appeared" >&2; exit 1; }
                 echo "waiting for dind TLS certs ($i)"; sleep 1
               done
+              j=0
+              until nc -z -w1 127.0.0.1 2376; do
+                j=$((j + 1))
+                [ "$j" -ge 60 ] && { echo "dind daemon never accepted connections on 2376" >&2; exit 1; }
+                echo "waiting for dind daemon on :2376 ($j)"; sleep 1
+              done
               exec /sbin/tini -- /opt/act/run.sh
           env:
             - name: GITEA_INSTANCE_URL