diff --git a/.forgejo/workflows/publish-container.yml b/.forgejo/workflows/publish-container.yml
index a135f1a..a808873 100644
--- a/.forgejo/workflows/publish-container.yml
+++ b/.forgejo/workflows/publish-container.yml
@@ -15,6 +15,10 @@ env:
 jobs:
   publish:
     runs-on: docker
+    env:
+      # Keep the runner-provided DOCKER_HOST when available.
+      # For common dind sidecar setups, this default works out of the box.
+      DOCKER_HOST: ${{ vars.DOCKER_HOST != '' && vars.DOCKER_HOST || 'tcp://forgejo-docker-in-docker:2375' }}
 
     steps:
       - name: Checkout
@@ -38,6 +42,37 @@ jobs:
           if [ -z "${{ secrets.FORGEJO_REGISTRY_USERNAME }}" ]; then echo "secrets.FORGEJO_REGISTRY_USERNAME is required"; exit 1; fi
           if [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then echo "secrets.FORGEJO_REGISTRY_TOKEN is required"; exit 1; fi
 
+      - name: Ensure Docker CLI exists
+        run: |
+          set -eu
+          if command -v docker >/dev/null 2>&1; then
+            docker --version
+            exit 0
+          fi
+
+          ARCH="$(uname -m)"
+          case "${ARCH}" in
+            x86_64) DOCKER_ARCH="x86_64" ;;
+            aarch64|arm64) DOCKER_ARCH="aarch64" ;;
+            *) echo "Unsupported architecture for Docker CLI bootstrap: ${ARCH}"; exit 1 ;;
+          esac
+
+          DOCKER_CLI_VERSION="27.5.1"
+          curl -fsSL "https://download.docker.com/linux/static/stable/${DOCKER_ARCH}/docker-${DOCKER_CLI_VERSION}.tgz" -o docker.tgz
+          tar -xzf docker.tgz
+          mkdir -p "${HOME}/.local/bin"
+          mv docker/docker "${HOME}/.local/bin/docker"
+          chmod +x "${HOME}/.local/bin/docker"
+          echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
+          "${HOME}/.local/bin/docker" --version
+
+      - name: Check Docker daemon connectivity
+        run: |
+          set -eu
+          echo "Using DOCKER_HOST=${DOCKER_HOST}"
+          docker version
+          docker info >/dev/null
+
       - name: Restore and publish app
         run: dotnet publish src/MaddoScientisto.Web/MaddoScientisto.Web.csproj -c Release -o ./artifacts/publish
 
diff --git a/README.md b/README.md
index 982b81f..dec7372 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,7 @@ Set these Forgejo Actions variables:
 - `FORGEJO_REGISTRY` (example: `forgejo.example.com`)
 - `IMAGE_NAMESPACE` (example: `maddo`)
 - `IMAGE_NAME` (example: `maddoscientisto-web`)
+- Optional: `DOCKER_HOST` (example: `tcp://forgejo-docker-in-docker:2375`)
 
 Set these Forgejo Actions secrets:
 
@@ -53,3 +54,12 @@ The workflow in `.forgejo/workflows/publish-container.yml` runs on pushes to `ma
 
 - `${FORGEJO_REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:latest`
 - `${FORGEJO_REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:sha-<12-char-commit>`
+
+## Forgejo runner notes (Docker-in-Docker)
+
+If the runner image does not contain the `docker` binary, the workflow bootstraps a Docker CLI in user space before login/build/push.
+
+For dind-based runners, ensure the job can reach your daemon over `DOCKER_HOST`.
+With your compose topology, the default `tcp://forgejo-docker-in-docker:2375` should work.
+
+If you still get connection failures after the CLI bootstrap step, set a repo variable named `DOCKER_HOST` to the correct daemon endpoint for your runner network.