diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index cbd27c22..b509aad8 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -336,6 +336,24 @@ in
         {
           system.stateVersion = "26.05";
 
+          # Resolve the hive's own forge domain to loopback inside the
+          # runner. The Forgejo Actions artifact API hands the runner an
+          # upload URL built from forgejo's ROOT_URL — the *public* forge
+          # domain (`forge.<domain>`), not the runner's
+          # `127.0.0.1:<httpPort>` registration URL. This container shares
+          # host netns but carries no resolver entry for the hive's own
+          # domains (the gateway's `localHostsEntry` only touches the host),
+          # so `actions/upload-artifact` dies with
+          #   Error: getaddrinfo ENOTFOUND forge.<domain>
+          # while normal CI is unaffected (checkout uses the localhost
+          # registration URL). Map the forge domain to loopback so the
+          # upload reaches the local forge — via the gateway on :80 when
+          # behindGateway, or forge directly on :httpPort otherwise. The
+          # gateway proxies all of `/` (artifact endpoints included), and a
+          # `localhost` domain (no hive-domain set) is already loopback, so
+          # this is a harmless no-op in that case.
+          networking.extraHosts = "127.0.0.1 ${forgeCfg.domain}";
+
           # nspawn containers can't create user-namespaces, so nix
           # sandboxing always fails. Fall back to unsandboxed builds.
           # See docs/gotchas.md.