diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml
index ebb0418..4c1c09f 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.github/workflows/build-docker-images.yml
@@ -71,41 +71,48 @@ jobs:
           echo "=== DNS resolution ==="
           getent hosts "$host" || nslookup "$host" || echo "DNS resolution FAILED for $host"
 
-          # This deployment multiplexes management + signal + dashboard
-          # behind Traefik on :443 (gRPC-over-HTTP/2). There is no separate
-          # :10000 signal port. The data plane is WireGuard on 51820/udp and
-          # STUN on 3478/udp -- those are the ports that actually matter for
-          # 'netbird up' to complete the tunnel handshake.
-
-          echo "=== Control plane: HTTPS :443 (mgmt + signal via Traefik) ==="
-          curl -sS -o /dev/null -w "HTTP %{http_code}  connect=%{time_connect}s  total=%{time_total}s\n" \
+          echo "=== Control plane: HTTPS :443 reachable? ==="
+          curl -sS -o /dev/null -w "HTTP %{http_code}  connect=%{time_connect}s\n" \
             --max-time 15 "https://${host}/" || echo "curl to :443 FAILED"
 
-          ip="$(getent hosts "$host" | awk '{print $1; exit}')"
-          echo "Resolved IP: ${ip:-<none>}"
+          # Other Netbird peers connect fine, so the server + 51820/udp are OK.
+          # 'netbird up' still hangs on THIS runner, which points to the runner
+          # container being unable to create the WireGuard tunnel interface.
+          # WireGuard needs a TUN device + NET_ADMIN capability inside the
+          # container; runner containers often lack these.
 
-          echo "=== Data plane: WireGuard 51820/udp (nc UDP probe) ==="
-          if command -v nc >/dev/null 2>&1; then
-            nc -zu -w 5 "$host" 51820 \
-              && echo "UDP 51820 appears OPEN/reachable" \
-              || echo "UDP 51820 probe returned non-zero (may be filtered/blocked -- prime suspect)"
+          echo "=== Runner: TUN device present? (/dev/net/tun) ==="
+          if [ -c /dev/net/tun ]; then
+            echo "/dev/net/tun EXISTS (char device)"
           else
-            echo "nc not available; installing..."
-            (apt-get update -qq && apt-get install -y -qq netcat-openbsd) >/dev/null 2>&1 || true
-            nc -zu -w 5 "$host" 51820 \
-              && echo "UDP 51820 appears OPEN/reachable" \
-              || echo "UDP 51820 probe returned non-zero (may be filtered/blocked -- prime suspect)"
+            echo "/dev/net/tun MISSING -- WireGuard cannot create a tunnel (LIKELY CAUSE)"
           fi
 
-          echo "=== STUN 3478/udp (nc UDP probe) ==="
-          nc -zu -w 5 "$host" 3478 \
-            && echo "UDP 3478 appears OPEN/reachable" \
-            || echo "UDP 3478 probe returned non-zero (may be filtered/blocked)"
+          echo "=== Runner: effective capabilities (need NET_ADMIN) ==="
+          if command -v capsh >/dev/null 2>&1; then
+            capsh --print 2>/dev/null | grep -i 'Current:' || true
+          else
+            grep -i CapEff /proc/self/status || true
+            echo "(decode with: capsh --decode=<hex>; NET_ADMIN is bit 12 / 0x1000)"
+          fi
 
-          echo "=== Outbound UDP allowed at all? (probe public STUN) ==="
-          nc -zu -w 5 stun.l.google.com 19302 \
-            && echo "General outbound UDP works (reached Google STUN)" \
-            || echo "General outbound UDP may be BLOCKED on this runner network"
+          echo "=== Runner: WireGuard tooling / kernel module ==="
+          command -v wg >/dev/null 2>&1 && echo "wg present" || echo "wg NOT present"
+          command -v wireguard-go >/dev/null 2>&1 && echo "wireguard-go (userspace) present" || echo "wireguard-go NOT present"
+          (lsmod 2>/dev/null | grep -q wireguard && echo "kernel wireguard module loaded") || echo "kernel wireguard module NOT loaded (userspace fallback needed)"
+
+          echo "=== Runner: can we create a dummy TUN? (definitive test) ==="
+          if command -v ip >/dev/null 2>&1; then
+            if ip tuntap add dev nbtest0 mode tun 2>/tmp/tunerr; then
+              echo "SUCCESS: created TUN interface -> NET_ADMIN + TUN available"
+              ip tuntap del dev nbtest0 mode tun 2>/dev/null || true
+            else
+              echo "FAILED to create TUN interface -> $(cat /tmp/tunerr)"
+              echo "This is almost certainly why 'netbird up' hangs."
+            fi
+          else
+            echo "iproute2 'ip' not available"
+          fi
 
           echo "=== done (this step never fails the build) ==="
         continue-on-error: true