diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 5c24893..a7d23c4 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -59,27 +59,48 @@ jobs:
           TAG="${GITHUB_REF#refs/tags/}"
           TOKEN_NAME="ci-release-$$"
 
-          # Generate temporary Gitea API token
+          # Generate temporary Gitea API token via docker exec (host Docker socket)
           # --user git = container OS user; -u calic = Gitea account
           TOKEN=$(docker exec --user git gitea gitea admin user generate-access-token \
-            -u calic -t "$TOKEN_NAME" --scopes all --raw 2>/dev/null)
+            -u calic -t "$TOKEN_NAME" --scopes all --raw)
+          if [ -z "$TOKEN" ]; then
+            echo "ERROR: Failed to generate Gitea API token"
+            exit 1
+          fi
+
+          # API calls use git.davoryn.de (NGINX proxy) — gitea:3000 is NOT
+          # resolvable from CI job containers (separate Docker network)
+          API="https://git.davoryn.de/api/v1"
 
           # Create release
-          RELEASE_ID=$(curl -sf \
+          echo "Creating release ${TAG}..."
+          RELEASE_RESP=$(curl -s -w "\n%{http_code}" \
             -H "Authorization: token ${TOKEN}" \
             -H "Content-Type: application/json" \
             -d "{\"tag_name\":\"${TAG}\",\"name\":\"Welcome Screen ${MOD_VERSION}\",\"body\":\"Release ${MOD_VERSION}\"}" \
-            "http://gitea:3000/api/v1/repos/calic/vs-welcome-screen/releases" \
-            | grep -oPm1 '"id":\K[0-9]+')
+            "${API}/repos/calic/vs-welcome-screen/releases")
+          HTTP_CODE=$(echo "$RELEASE_RESP" | tail -1)
+          RELEASE_BODY=$(echo "$RELEASE_RESP" | sed '$d')
+
+          if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+            echo "ERROR: Release creation failed (HTTP ${HTTP_CODE}): ${RELEASE_BODY}"
+            # Clean up token before exiting
+            curl -s -X DELETE -u "calic:${TOKEN}" "${API}/users/calic/tokens/${TOKEN_NAME}" >/dev/null 2>&1 || true
+            exit 1
+          fi
+
+          RELEASE_ID=$(echo "$RELEASE_BODY" | grep -oPm1 '"id":\K[0-9]+')
+          echo "Release created (id: ${RELEASE_ID})"
 
           # Attach mod ZIP to release
+          echo "Uploading ${MOD_ZIP}..."
           curl -sf \
             -H "Authorization: token ${TOKEN}" \
             -F "attachment=@${MOD_ZIP}" \
-            "http://gitea:3000/api/v1/repos/calic/vs-welcome-screen/releases/${RELEASE_ID}/assets"
+            "${API}/repos/calic/vs-welcome-screen/releases/${RELEASE_ID}/assets"
 
           echo "Release ${TAG} created with ${MOD_ZIP}"
 
           # Clean up token
-          curl -sf -X DELETE -u "calic:${TOKEN}" \
-            "http://gitea:3000/api/v1/users/calic/tokens/${TOKEN_NAME}" >/dev/null 2>&1 || true
+          curl -s -X DELETE -u "calic:${TOKEN}" \
+            "${API}/users/calic/tokens/${TOKEN_NAME}" >/dev/null 2>&1 || true