diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 72f690f..2e290eb 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -128,7 +128,22 @@ jobs:
           # the job (an orphaned `logs -f` dies on its own when cleanup removes the container).
           E2E_DEPLOY_CMD: "docker compose -f docker-compose.ci.yml -p flight-ci build --progress=plain && docker compose -f docker-compose.ci.yml -p flight-ci up -d && docker compose -f docker-compose.ci.yml -p flight-ci logs -f"
           E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml -p flight-ci"
-        run: npx playwright test
+          # Chromium honors proxy env vars on Linux (node-side HTTP does not) — keep the
+          # in-network app host out of any proxy path.
+          NO_PROXY: app,localhost,127.0.0.1,.kkhost.pl
+          no_proxy: app,localhost,127.0.0.1,.kkhost.pl
+        run: |
+          # --- e2e connectivity diagnostics (non-fatal; evidence for ERR_SSL_PROTOCOL_ERROR hunt) ---
+          echo "=== proxy env ==="
+          env | grep -iE '^(http_proxy|https_proxy|all_proxy|no_proxy)=' || echo "(none set)"
+          echo "=== /etc/hosts ==="
+          cat /etc/hosts
+          echo "=== DNS for app ==="
+          getent hosts app || echo "getent: no result"
+          echo "=== curl http://app:3000/api/version (node-side) ==="
+          timeout 15 curl -sv http://app:3000/api/version 2>&1 | head -40 || true
+          # --- end diagnostics ---
+          npx playwright test
 
       # The daemon is shared with production — never leave our stack or network behind.
       # -v drops the named DB volume so every run seeds fresh (no schema drift between PRs).
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dfb1f90..eef082b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@
 - **CI flaky-network handling settled on retry wrappers** (transient EAI_AGAIN failures seen in runs #10/#11): bun install, dependency install and the e2e image build each retry up to 3× with 5s between attempts before failing — run #12 with this setup got furthest (build + unit + browsers green). A short-lived "DNS diagnostics" step was tried but removed: its daemon-side probe pulled an image not present on the runner's docker daemon and stalled runs #13/#14 at Setup Node
 - **E2e image build needs no outbound network from dind build containers** (DNSResolveFailed in `RUN bun install` across runs #10/#12/#15): node_modules is now installed in the CI job / dev host and copied into the build context (.dockerignore no longer excludes it; Dockerfile COPYs it instead of running any install inside the image); base images switched alpine → node:22-slim (glibc) for native-module ABI compatibility with the job-installed tree (@next/swc-*, sharp are prebuilt per platform — CI job and prod host are x86_64 glibc linux); a "Pull e2e base image" step fails fast if the daemon can't fetch node:22-slim
 - **CI e2e deploy command stays alive** (`E2E_DEPLOY_CMD` now ends with `docker compose … logs -f`): Playwright's webServer requires a long-running process — `up -d` returns immediately and triggered "Process from config.webServer exited early" (run #16); `logs -f` also streams app logs into CI output for debugging
+- **CI e2e step bypasses proxies for the in-network app host** (`NO_PROXY`/`no_proxy=app,localhost,127.0.0.1,.kkhost.pl`) and prints proxy/DNS/curl diagnostics before the suite — run #18 showed Chromium getting `ERR_SSL_PROTOCOL_ERROR` on http://app:3000 while node-side HTTP worked (9 API-only tests passed), pointing at a TLS-terminating proxy env var that Chromium honors but Node's HTTP client ignores
 - Verified: unit suite 234 green locally; e2e not run locally by design (would deploy to production) — first real pass happens in the PR's CI run
 
 ## v0.12.2 — 2026-09-18 14:06