diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 51a6917..a2c9fff 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -78,7 +78,18 @@ build_image:
       variables:
         HEALTHCHECK_TCP_PORT: "2375"
   before_script:
-    - until docker info >/dev/null 2>&1; do echo "Waiting for Docker daemon..."; sleep 1; done
+    - |
+      attempts=0
+      until docker info >/dev/null 2>&1; do
+        attempts=$((attempts + 1))
+        if [ "$attempts" -ge 60 ]; then
+          echo "Docker daemon did not become ready after 60 seconds." >&2
+          echo "On self-hosted runners, docker:dind requires the runner Docker executor to run with privileged = true." >&2
+          exit 1
+        fi
+        echo "Waiting for Docker daemon..."
+        sleep 1
+      done
     # Prefer GitLab's built-in registry variables, but allow explicit fallbacks
     # so the pipeline can publish to any OCI-compatible registry.
     - export REGISTRY_HOST="${CI_REGISTRY:-${REGISTRY_HOST:-}}"