diff --git a/src/com/homelab/stages/buildDocker.groovy b/src/com/homelab/stages/buildDocker.groovy
index e736c35..31902a3 100644
--- a/src/com/homelab/stages/buildDocker.groovy
+++ b/src/com/homelab/stages/buildDocker.groovy
@@ -24,6 +24,7 @@ def run(Map config) {
     try {
         stage(stageName('Build & push image')) {
             container('docker-cli') {
+                waitForDockerDaemon()
                 dir("${config.repo_name}") {
                     if (!fileExists('Dockerfile')) {
                         renderDockerfile(config)
@@ -43,6 +44,25 @@ def run(Map config) {
     return tag
 }
 
+// Kubernetes doesn't guarantee container-start ordering within a pod, so
+// the sibling `docker` (dind) container can still be initializing
+// (iptables detection, cert-dir checks, etc. run on every start) when
+// this container's very first `sh` step fires — hit exactly this as
+// "Cannot connect to the Docker daemon at tcp://localhost:2375" on a
+// build that had worked fine moments earlier. Poll rather than assume
+// instant availability.
+def waitForDockerDaemon() {
+    sh '''
+        for i in $(seq 1 30); do
+            docker info >/dev/null 2>&1 && exit 0
+            echo "Waiting for docker daemon to be ready... ($i/30)"
+            sleep 2
+        done
+        echo "docker daemon never became ready" >&2
+        exit 1
+    '''
+}
+
 // Only reached when the repo has no Dockerfile of its own. Requires
 // config.dockerBuildVersion (e.g. 'go-1.22') — there's no sensible
 // default to fall back to if a repo has neither a Dockerfile nor this