diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index 5b3d34c0..fdcb5039 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -94,6 +94,22 @@ jobs:
           BASIC_AUTH_PASS: ${{ secrets.BASIC_AUTH_PASS }}
         run: scripts/ci/wait-for-url.sh https://ui-dashboard.gnerim.ru/ 30 2
 
+      - name: Diagnose tunnel reachability
+        id: tunnel_check
+        env:
+          BASIC_AUTH_USER: ${{ secrets.BASIC_AUTH_USER }}
+          BASIC_AUTH_PASS: ${{ secrets.BASIC_AUTH_PASS }}
+        run: |
+          echo "--- /api/health (expect 200 + x-envoy-upstream-service-time + x-cache-status) ---"
+          curl -k -sSI -u "$BASIC_AUTH_USER:$BASIC_AUTH_PASS" https://ui-dashboard.gnerim.ru/api/health | head -15
+          echo "--- /api/dictionary/1/world_regions (expect JSON, ~5KB) ---"
+          curl -k -sS -u "$BASIC_AUTH_USER:$BASIC_AUTH_PASS" \
+            -w "\n[size=%{size_download} time=%{time_total}s code=%{http_code}]\n" \
+            https://ui-dashboard.gnerim.ru/api/dictionary/1/world_regions | head -c 400; echo
+          echo "--- second hit on the same dict (expect HIT) ---"
+          curl -k -sSI -u "$BASIC_AUTH_USER:$BASIC_AUTH_PASS" \
+            https://ui-dashboard.gnerim.ru/api/dictionary/1/world_regions | grep -iE "^HTTP|x-cache|x-envoy"
+
       - name: Install Playwright browsers
         id: playwright_install
         run: pnpm exec playwright install --with-deps chromium