diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/build-deploy.yml
index 4d8a509..cf6f0f5 100644
--- a/.gitea/workflows/build-deploy.yml
+++ b/.gitea/workflows/build-deploy.yml
@@ -13,13 +13,28 @@ jobs:
       - name: Install system dependencies
         run: |
           apt-get update
-          apt-get install -y --no-install-recommends git rsync openssh-client nodejs
+          apt-get install -y --no-install-recommends git rsync openssh-client nodejs netcat-openbsd dnsutils
 
       - name: Checkout
         uses: actions/checkout@v4
         with:
           submodules: false
 
+      # Temporary diagnostic step — remove once the aquaria connectivity
+      # issue is root-caused. ssh-keyscan swallows pre-handshake failures
+      # even with -v, so this checks DNS + raw TCP connect independently.
+      - name: Diagnose connectivity to deploy host
+        env:
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
+        run: |
+          echo "--- DNS resolution ---"
+          getent hosts "$DEPLOY_HOST" || echo "getent: no result"
+          dig +short A "$DEPLOY_HOST" || true
+          dig +short AAAA "$DEPLOY_HOST" || true
+          echo "--- TCP connect (IPv4) ---"
+          nc -4 -zv -w 8 "$DEPLOY_HOST" "${DEPLOY_PORT:-22}" || echo "nc exit code: $?"
+
       - name: Set up SSH key
         # Same key used both as the theme repo's deploy key (Gitea) and for
         # the webserver login (below) — one secret, two authorized_keys entries.