diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index a754009..968acaf 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -17,8 +17,6 @@ jobs:
           POSTGRES_USER: damascus
           POSTGRES_PASSWORD: damascus
           POSTGRES_DB: damascus
-        ports:
-          - "5432:5432"
         options: >-
           --health-cmd "pg_isready -U damascus -d damascus"
           --health-interval 5s
@@ -28,7 +26,12 @@ jobs:
     env:
       DAMASCUS_ROOT: ${{ github.workspace }}
       DAMASCUS_SCHEMA_PATH: ${{ github.workspace }}/schema.sql
-      DAMASCUS_PG_HOST: 127.0.0.1
+      # The postgres service is reachable by its service name on the runner
+      # network. We tried 127.0.0.1 + a host port binding first; the binding
+      # is racy on self-hosted act_runner (the port map sometimes takes
+      # effect after the job tries to connect, causing "Connection refused").
+      # Service-name DNS is reliable.
+      DAMASCUS_PG_HOST: postgres
       DAMASCUS_PG_PORT: "5432"
       DAMASCUS_PG_USER: damascus
       DAMASCUS_PG_PASSWORD: damascus