diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml
index 2f7b7d7..86ecd69 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.github/workflows/build-docker-images.yml
@@ -53,6 +53,35 @@ jobs:
     needs: build
 
     steps:
+      - name: Debug Netbird connectivity
+        env:
+          NB_URL: ${{ secrets.NETBIRD_URL }}
+          NB_KEY: ${{ secrets.NETBIRD_SETUP_KEY }}
+        run: |
+          echo "=== Secret presence (values are masked) ==="
+          echo "NETBIRD_URL length: ${#NB_URL}"
+          echo "NETBIRD_SETUP_KEY length: ${#NB_KEY}"
+          if [ -z "$NB_URL" ]; then echo "WARNING: NETBIRD_URL is EMPTY"; fi
+          if [ -z "$NB_KEY" ]; then echo "WARNING: NETBIRD_SETUP_KEY is EMPTY"; fi
+
+          # Derive host from the URL without printing the full URL.
+          host="$(printf '%s' "$NB_URL" | sed -E 's#^[a-zA-Z]+://##; s#[:/].*$##')"
+          echo "Derived management host: ${host:-<none>}"
+
+          echo "=== DNS resolution ==="
+          getent hosts "$host" || nslookup "$host" || echo "DNS resolution FAILED for $host"
+
+          echo "=== HTTPS reachability (management API, :443) ==="
+          curl -sS -o /dev/null -w "HTTP %{http_code}  connect=%{time_connect}s  total=%{time_total}s\n" \
+            --max-time 15 "https://${host}/" || echo "curl to management API FAILED"
+
+          echo "=== Signal server port (:10000 gRPC) TCP check ==="
+          timeout 10 bash -c "cat < /dev/null > /dev/tcp/${host}/10000" \
+            && echo "TCP :10000 reachable" || echo "TCP :10000 NOT reachable (signal server / firewall?)"
+
+          echo "=== done (this step never fails the build) ==="
+        continue-on-error: true
+
       - name: Netbird Connect
         uses: Alemiz112/netbird-connect@v1
         with: