diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 55abbd1..d54e1c5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -112,6 +112,31 @@ build_image:
     - test -n "$IMAGE_REPOSITORY" || { echo "Image repository is not set. Configure CI_REGISTRY_IMAGE or REGISTRY_IMAGE."; exit 1; }
     - export DOCKER_IMAGE="$IMAGE_REPOSITORY:$CI_COMMIT_SHORT_SHA"
     - export DOCKER_IMAGE_LATEST="$IMAGE_REPOSITORY:latest"
+    - |
+      echo "--- Registry Connectivity Preflight ---"
+      echo "REGISTRY_HOST=$REGISTRY_HOST"
+      cat /etc/resolv.conf || true
+
+      if command -v getent >/dev/null 2>&1; then
+        getent hosts "$REGISTRY_HOST" || true
+      elif command -v nslookup >/dev/null 2>&1; then
+        nslookup "$REGISTRY_HOST" || true
+      else
+        echo "No host lookup tool available in runner image."
+      fi
+
+      probe_output="$(wget -S --spider --timeout=15 --tries=1 "https://$REGISTRY_HOST/v2/" 2>&1 || true)"
+      printf '%s\n' "$probe_output"
+
+      printf '%s\n' "$probe_output" | grep -F "401 Unauthorized" >/dev/null || {
+        echo "Registry preflight failed: expected HTTPS /v2/ to return 401 Unauthorized before docker login." >&2
+        exit 1
+      }
+
+      printf '%s\n' "$probe_output" | grep -Fi "Docker-Distribution-Api-Version: registry/2.0" >/dev/null || {
+        echo "Registry preflight failed: registry API header missing from HTTPS /v2/ response." >&2
+        exit 1
+      }
     - echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin
   script:
     - echo "--- Building Docker Image ---"