diff --git a/.gitea/workflows/test-build.yaml b/.gitea/workflows/test-build.yaml
index 4e6190c..c83283a 100644
--- a/.gitea/workflows/test-build.yaml
+++ b/.gitea/workflows/test-build.yaml
@@ -1,9 +1,5 @@
 name: Test build-and-push (self-test)
 
-# Validates the build-and-push composite action end-to-end against the remote
-# docker-build.haven buildx builder, using a tiny throwaway image. Runs on
-# manual dispatch and whenever the action itself changes.
-
 on:
   workflow_dispatch: {}
   push:
@@ -14,8 +10,6 @@ on:
       - .gitea/workflows/test-build.yaml
 
 env:
-  # Throwaway image ref — kept separate from any real project image so this
-  # self-test can never clobber a production tag.
   IMAGE: git.ivanch.me/ivanch/pipeline-actions-selftest
 
 jobs:
diff --git a/build-and-push/action.yaml b/build-and-push/action.yaml
index 047d5b6..4c319b9 100644
--- a/build-and-push/action.yaml
+++ b/build-and-push/action.yaml
@@ -73,12 +73,30 @@ runs:
 
         # Fail fast with a real diagnostic instead of a slow buildx
         # "context deadline exceeded" if the runner can't reach / auth to the
-        # remote docker daemon over SSH.
+        # remote docker daemon over SSH. A hard `timeout` wrapper guarantees we
+        # never hang: ConnectTimeout only bounds the TCP handshake, so a
+        # firewall that accepts the SYN but drops later packets would otherwise
+        # stall SSH negotiation indefinitely.
         echo "== probing ssh://${BUILDER_USER}@${BUILDER_HOST} =="
-        ssh -o BatchMode=yes -o ConnectTimeout=10 \
-          -i ~/.ssh/id_ed25519 \
-          "${BUILDER_USER}@${BUILDER_HOST}" \
-          'docker version --format "server={{.Server.Version}}"'
+        if timeout 25 ssh \
+             -o BatchMode=yes \
+             -o ConnectTimeout=10 \
+             -o ServerAliveInterval=5 \
+             -o ServerAliveCountMax=2 \
+             -o StrictHostKeyChecking=accept-new \
+             -i ~/.ssh/id_ed25519 \
+             "${BUILDER_USER}@${BUILDER_HOST}" \
+             'docker version --format "server={{.Server.Version}}"'; then
+          echo "SSH probe OK"
+        else
+          rc=$?
+          echo "SSH probe FAILED (exit ${rc})"
+          if [ "${rc}" = "124" ]; then
+            echo "-> timed out: TCP likely opens but SSH negotiation stalls."
+            echo "-> Check firewall path runner -> ${BUILDER_HOST}:22 (VLAN), or MTU."
+          fi
+          exit "${rc}"
+        fi
 
     - name: Set up remote Docker Buildx builder
       shell: bash