diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4f84de5..40ca079 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -28,6 +28,17 @@ jobs:
           fi
           nomad version
 
+      - name: Check Nomad connection
+        run: |
+          if [ -z "$NOMAD_ADDR" ]; then
+            echo "❌ NOMAD_ADDR secret is empty/unset — nomad would fall back to http://127.0.0.1:4646."
+            echo "   Set repo secrets NOMAD_ADDR and NOMAD_TOKEN in Gitea → Settings → Actions → Secrets."
+            exit 1
+          fi
+          echo "→ NOMAD_ADDR=$NOMAD_ADDR"
+          # Fails clearly if the runner can't reach the Nomad API (network/token).
+          nomad node status >/dev/null
+
       - name: Validate job
         run: nomad job validate continuwuity.hcl