During the DNS cutover the Hetzner resolvers nixos-infect had left in networking.nix still served the old address (3h TTL) while 1.1.1.1/8.8.8.8 had the new one, so every other lookup of drone.ci.commoninternet.net from the box itself went to the old server: runner "cannot request stage 404", bridge "drone trigger failed 404", traefik probes alternating 200/404. Drop those resolvers; pin ci/drone/report/traefik/warm-keycloak/oc names to this host in networking.hosts. README §7 records it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz