diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 2bfd66f..cb93232 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -237,9 +237,26 @@ jobs:
           username: ${{ secrets.IFT_SSH_USER }}
           key: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
           script: |
+            set -euo pipefail
             export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
             export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            bash /opt/eventhub-ift/devops/scripts/deploy-service.sh ift core ${{ steps.meta.outputs.tag }}
+            TAG='${{ steps.meta.outputs.tag }}'
+            # Host DNS preflight (Docker Desktop forwarder 192.168.*.1 часто timeout).
+            for i in 1 2 3 4 5; do
+              if getent ahostsv4 git.sabilin.com >/dev/null 2>&1 \
+                || getent hosts git.sabilin.com >/dev/null 2>&1 \
+                || dig +short git.sabilin.com A 2>/dev/null | grep -qE '^[0-9.]+$'; then
+                echo "OK: git.sabilin.com resolves on host"
+                break
+              fi
+              echo "wait DNS git.sabilin.com (${i}/5)..."
+              sleep $((i * 2))
+              if [[ "${i}" -eq 5 ]]; then
+                echo "FAIL: git.sabilin.com not resolvable on IFT host"
+                exit 1
+              fi
+            done
+            bash /opt/eventhub-ift/devops/scripts/deploy-service.sh ift core "${TAG}"
 
       - name: Prune old registry images
         env:
@@ -356,9 +373,25 @@ jobs:
           username: ${{ secrets.STAGE_SSH_USER }}
           key: ${{ secrets.STAGE_SSH_PRIVATE_KEY }}
           script: |
+            set -euo pipefail
             export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
             export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage core ${{ steps.meta.outputs.tag }}
+            TAG='${{ steps.meta.outputs.tag }}'
+            for i in 1 2 3 4 5; do
+              if getent ahostsv4 git.sabilin.com >/dev/null 2>&1 \
+                || getent hosts git.sabilin.com >/dev/null 2>&1 \
+                || dig +short git.sabilin.com A 2>/dev/null | grep -qE '^[0-9.]+$'; then
+                echo "OK: git.sabilin.com resolves on host"
+                break
+              fi
+              echo "wait DNS git.sabilin.com (${i}/5)..."
+              sleep $((i * 2))
+              if [[ "${i}" -eq 5 ]]; then
+                echo "FAIL: git.sabilin.com not resolvable on stage host"
+                exit 1
+              fi
+            done
+            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage core "${TAG}"
 
       - name: Prune old registry images
         continue-on-error: true