diff --git a/servers/legion/k8s/gitea-runner/deployment.yaml b/servers/legion/k8s/gitea-runner/deployment.yaml
index c99798d..0ed368d 100644
--- a/servers/legion/k8s/gitea-runner/deployment.yaml
+++ b/servers/legion/k8s/gitea-runner/deployment.yaml
@@ -8,7 +8,7 @@ metadata:
   labels:
     app: gitea-runner
   annotations:
-    config-version: "2026-05-05-proxy-roll"
+    config-version: "2026-05-05-extra-hosts"
 spec:
   replicas: 1
   selector:
@@ -19,7 +19,7 @@ spec:
       labels:
         app: gitea-runner
       annotations:
-        config-version: "2026-05-05-proxy-roll"
+        config-version: "2026-05-05-extra-hosts"
     spec:
       securityContext:
         runAsNonRoot: false
@@ -45,16 +45,15 @@ spec:
                 force_pull: true
                 valid_volumes: []
                 default_image: "registry.neuralplatform.ai/ci-base:latest"
-                # Build containers run with network: host. The in-cluster
-                # gitea name does not resolve there, so we redirect git
-                # operations to https://git.neuralplatform.ai using CF
-                # Access service-token headers. BASH_ENV makes bash source
-                # /usr/local/bin/git-cf-access-init.sh before every step,
-                # which sets up the redirect + headers.
                 env:
                   GITEA_SSH_PRIVATE_KEY: "${GITEA_SSH_PRIVATE_KEY}"
                   BASH_ENV: "/usr/local/bin/git-ssh-init.sh"
-                extra_hosts: []
+                # Build containers run with network: host, so k8s DNS names
+                # don't resolve. Inject the gitea-proxy ClusterIP so that
+                # actions/checkout can reach gitea-proxy.ci.svc.cluster.local
+                # (the URL Gitea passes as GITHUB_SERVER_URL to the runner).
+                extra_hosts:
+                  - "gitea-proxy.ci.svc.cluster.local:10.43.88.7"
               EOF
           envFrom:
             - secretRef:
@@ -100,7 +99,7 @@ metadata:
   labels:
     app: neuron-technologies-runner
   annotations:
-    config-version: "2026-05-05-proxy-roll"
+    config-version: "2026-05-05-extra-hosts"
 spec:
   replicas: 2
   selector:
@@ -111,7 +110,7 @@ spec:
       labels:
         app: neuron-technologies-runner
       annotations:
-        config-version: "2026-05-05-proxy-roll"
+        config-version: "2026-05-05-extra-hosts"
     spec:
       securityContext:
         runAsNonRoot: false
@@ -137,16 +136,15 @@ spec:
                 force_pull: true
                 valid_volumes: []
                 default_image: "registry.neuralplatform.ai/ci-base:latest"
-                # Build containers run with network: host. The in-cluster
-                # gitea name does not resolve there, so we redirect git
-                # operations to https://git.neuralplatform.ai using CF
-                # Access service-token headers. BASH_ENV makes bash source
-                # /usr/local/bin/git-cf-access-init.sh before every step,
-                # which sets up the redirect + headers.
+                # Build containers run with network: host, so k8s DNS names
+                # don't resolve. Inject the gitea-proxy ClusterIP so that
+                # actions/checkout can reach gitea-proxy.ci.svc.cluster.local
+                # (the URL Gitea passes as GITHUB_SERVER_URL to the runner).
                 env:
                   GITEA_SSH_PRIVATE_KEY: "${GITEA_SSH_PRIVATE_KEY}"
                   BASH_ENV: "/usr/local/bin/git-ssh-init.sh"
-                extra_hosts: []
+                extra_hosts:
+                  - "gitea-proxy.ci.svc.cluster.local:10.43.88.7"
               EOF
           envFrom:
             - secretRef: