diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1a7004010..e6bc1d07c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -29,7 +29,7 @@ variables:
     - kapsule
     - rust
   before_script:
-    - apt-get update && apt-get install -y protobuf-compiler curl pkg-config libssl-dev
+    - apt-get update && apt-get install -y git protobuf-compiler curl pkg-config libssl-dev
     - curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.8.1/sccache-v0.8.1-x86_64-unknown-linux-musl.tar.gz
       | tar xz --strip-components=1 -C /usr/local/bin sccache-v0.8.1-x86_64-unknown-linux-musl/sccache
     - chmod +x /usr/local/bin/sccache
diff --git a/infra/k8s/gitlab/runner-values.yaml b/infra/k8s/gitlab/runner-values.yaml
index 6f2cb9b7a..68c52faf0 100644
--- a/infra/k8s/gitlab/runner-values.yaml
+++ b/infra/k8s/gitlab/runner-values.yaml
@@ -16,8 +16,11 @@ tolerations:
     effect: NoSchedule
 
 runners:
+  # Override clone URL to internal service (pods can't reach Tailscale IPs)
+  cloneUrl: http://gitlab-webservice-default.foxhunt.svc.cluster.local:8181
   config: |
     [[runners]]
+      clone_url = "http://gitlab-webservice-default.foxhunt.svc.cluster.local:8181"
       [runners.kubernetes]
         namespace = "foxhunt"
         image = "rust:1.89-slim"