diff --git a/k8s/security/ci-cd/charts/forgejo-runner/values.yaml b/k8s/security/ci-cd/charts/forgejo-runner/values.yaml
index 74c9832..be38c31 100644
--- a/k8s/security/ci-cd/charts/forgejo-runner/values.yaml
+++ b/k8s/security/ci-cd/charts/forgejo-runner/values.yaml
@@ -4,7 +4,9 @@ runner:
     tag: "6"          # pin exact release before apply
   name: talos-runner
   labels: "docker:docker://node:22-bookworm"
-  forgejoUrl: https://forgejo.riotpiao.com
+  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
+  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
+  forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
   # tokenSecret: name of the K8s Secret that holds the runner registration token
   # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
   tokenSecret: runner-token