diff --git a/.github/workflows/probe-buildkitd.yml b/.github/workflows/probe-buildkitd.yml
new file mode 100644
index 0000000..0a444c9
--- /dev/null
+++ b/.github/workflows/probe-buildkitd.yml
@@ -0,0 +1,65 @@
+name: probe registry from buildkitd
+
+# TEMPORARY probe branch — not for merge.
+#
+# The first probe ran in the RUNNER pod. buildkitd is a different pod in a
+# different namespace with its own NetworkPolicies, so those results cannot be
+# transferred: an UNREACHABLE there may be the runner's policy, not routing.
+# This runs the same probes THROUGH buildkitd, by building a stage whose RUN
+# does the curling — that egresses from the buildkitd pod, which is the network
+# position that actually has to push.
+#
+# It prints results and always exits 0: this is a measurement, not a gate.
+
+on:
+  workflow_dispatch:
+
+env:
+  BUILDKIT_HOST: tcp://buildkitd.buildkit-system.svc.cluster.local:1234
+  BUILDKIT_VERSION: v0.32.2
+
+jobs:
+  probe:
+    if: ${{ github.server_url != 'https://github.com' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Install buildctl
+        run: |
+          set -euo pipefail
+          case "$(uname -m)" in x86_64) arch=amd64;; aarch64) arch=arm64;; *) exit 1;; esac
+          mkdir -p "$GITHUB_WORKSPACE/.bin"
+          curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
+            | tar -xz -C "$GITHUB_WORKSPACE/.bin" --strip-components=1 bin/buildctl
+          echo "$GITHUB_WORKSPACE/.bin" >> "$GITHUB_PATH"
+          "$GITHUB_WORKSPACE/.bin/buildctl" --version
+
+      - name: Probe from inside buildkitd
+        run: |
+          set -euo pipefail
+          work=$(mktemp -d)
+          {
+            echo 'FROM alpine:3.20'
+            echo 'RUN apk add --no-cache curl >/dev/null 2>&1 || true'
+            echo 'RUN set -u; \'
+            echo '  f="http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}\\n"; \'
+            echo '  echo "== public name via cluster DNS =="; \'
+            echo '  curl -s -o /dev/null -w "$f" --max-time 8 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
+            echo '  echo "== resolves to =="; getent hosts gitea.langenoja.se || echo "(none)"; \'
+            echo '  echo "== istio-gateway external lb 10.40.0.10 =="; \'
+            echo '  curl -s -o /dev/null -w "$f" --max-time 8 --resolve gitea.langenoja.se:443:10.40.0.10 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
+            echo '  echo "== istio-gateway clusterip 10.43.1.114 =="; \'
+            echo '  curl -s -o /dev/null -w "$f" --max-time 8 --resolve gitea.langenoja.se:443:10.43.1.114 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
+            echo '  echo "== gitea http service in-cluster =="; \'
+            echo '  curl -s -o /dev/null -w "$f" --max-time 8 http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ || echo UNREACHABLE; \'
+            echo '  echo "== gitea http service, headers =="; \'
+            echo '  curl -s -D- -o /dev/null --max-time 8 http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ | head -5 || true'
+          } > "$work/Dockerfile"
+          cat "$work/Dockerfile"
+          buildctl build --progress=plain \
+            --frontend dockerfile.v0 \
+            --local context="$work" \
+            --local dockerfile="$work" \
+            --opt platform=linux/amd64 \
+            --output type=cacheonly 2>&1 | grep -vE "^#[0-9]+ (sha256|extracting|resolve|DONE|CACHED)" | tail -40
+          echo "probe finished (results above, from buildkitd's network position)"