diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d1f2429..312c576 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -233,7 +233,14 @@ jobs:
       - name: Run harness (start API + Playwright iphone + pixel)
         env:
           CI: 'true'
-          PLAYWRIGHT_BASE_URL: http://localhost:5173
+          # Use 127.0.0.1 (not localhost): the runner image resolves `localhost` to ::1 first,
+          # but the Vite dev server binds IPv4-only (127.0.0.1:5173). global-setup.ts uses Node
+          # fetch (no IPv4 fallback, unlike curl), so localhost→::1:5173 → ECONNREFUSED → its
+          # /health poll never returns 200. Proven via [::1]:5173 ECONNREFUSED vs 127.0.0.1:5173 200.
+          # --dns-result-order=ipv4first is defense-in-depth for any remaining localhost hop
+          # (Vite's /health proxy → localhost:3000; the API is dual-stack so that hop already works).
+          PLAYWRIGHT_BASE_URL: http://127.0.0.1:5173
+          NODE_OPTIONS: '--dns-result-order=ipv4first'
           DEV_AUTH_BYPASS: 'true'
           NODE_ENV: development
           DB_HOST: mariadb