diff --git a/.github/workflows/registry-ci.yml b/.github/workflows/registry-ci.yml
index 12a128014..179154cd1 100644
--- a/.github/workflows/registry-ci.yml
+++ b/.github/workflows/registry-ci.yml
@@ -28,11 +28,15 @@ jobs:
             port: 3306
             health_cmd: 'mariadb-admin ping -h 127.0.0.1 -uroot -p"$MARIADB_ROOT_PASSWORD" --silent'
 
-
     # Exactly ONE service container per matrix run (the image changes)
     services:
       db:
         image: ${{ matrix.db.image }}
+        # Publish the DB port so the job can connect via Docker-host networking.
+        # NOTE: If your runner executes steps in a container, 127.0.0.1 won't work;
+        # we compute the Docker host gateway IP in a later step.
+        ports:
+          - ${{ matrix.db.port }}:${{ matrix.db.port }}
         env:
           # Postgres vars (used only by postgres image)
           POSTGRES_DB: registry_test
@@ -62,17 +66,13 @@ jobs:
       # Matrix DB selection for this run
       DB_ENGINE: ${{ matrix.db.engine }}
 
-      # DB service connection info (because you publish ports)
-#      COMANAGE_REGISTRY_DATABASE_HOST: db
-#      COMANAGE_REGISTRY_DATABASE_PORT: ${{ matrix.db.port }}
-
       # Values used by your PHPUnit setup test
       COMANAGE_REGISTRY_ADMIN_GIVEN_NAME: Admin
       COMANAGE_REGISTRY_ADMIN_FAMILY_NAME: User
       COMANAGE_REGISTRY_ADMIN_USERNAME: admin
       COMANAGE_REGISTRY_SECURITY_SALT: phpunit-security-salt
 
-      # Values used by tests/bootstrap.php to create containers (host/port are set dynamically after start)
+      # DB credentials/name (host/port will be set dynamically in a step)
       COMANAGE_REGISTRY_DATABASE: registry_test
       COMANAGE_REGISTRY_DATABASE_USER: test_user
       COMANAGE_REGISTRY_DATABASE_USER_PASSWORD: test_password
@@ -82,25 +82,26 @@ jobs:
       - name: Show OS info
         shell: bash
         run: |
-          cat /etc/os-release
+          set -euxo pipefail
+          cat /etc/os-release || true
           uname -a
 
-      - name: Upgrade OS version
+      - name: Upgrade OS packages
         shell: bash
         run: |
           set -euxo pipefail
           sudo apt-get update
           sudo apt-get upgrade -y
 
-      - name: Checkout (only for workflow files)
+      - name: Checkout repository at the exact commit
         shell: bash
         run: |
           set -euxo pipefail
-          git clone \
-            --depth=1 \
-            --branch "${GITHUB_REF_NAME}" \
-            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" \
-            "${COMANAGE_REGISTRY_DIR}"
+          git clone "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "${COMANAGE_REGISTRY_DIR}"
+          cd "${COMANAGE_REGISTRY_DIR}"
+          git fetch --no-tags --prune --depth=1 origin "${GITHUB_SHA}"
+          git checkout --force "${GITHUB_SHA}"
+          git rev-parse HEAD
 
       - name: Install PHP ${{ matrix.php }} and extensions
         shell: bash
@@ -110,6 +111,7 @@ jobs:
             software-properties-common ca-certificates gnupg
           sudo add-apt-repository -y ppa:ondrej/php
           sudo apt-get update
+
           PHP_VER="${{ matrix.php }}"
           sudo apt-get install -y --no-install-recommends \
             php${PHP_VER}-cli \
@@ -125,13 +127,11 @@ jobs:
             php${PHP_VER}-xsl \
             php${PHP_VER}-memcached \
             php${PHP_VER}-curl
-          # Force the correct version via update-alternatives
+
           sudo update-alternatives --set php /usr/bin/php${PHP_VER}
-          # Also override via /usr/local/bin which is earlier in PATH
           sudo ln -sf /usr/bin/php${PHP_VER} /usr/local/bin/php
-          # Persist for subsequent steps
+
           echo "PHP_VER=${PHP_VER}" >> "$GITHUB_ENV"
-          # Prepend /usr/local/bin to PATH for all subsequent steps
           echo "/usr/local/bin" >> "$GITHUB_PATH"
 
       - name: Install OS packages needed for setup
@@ -166,7 +166,7 @@ jobs:
           echo "${DOCKER_HOST-}"
           docker context show
 
-      - name: Wait for DB to be ready
+      - name: Wait for DB to be ready (inside the service container)
         shell: bash
         run: |
           set -euxo pipefail
@@ -186,64 +186,65 @@ jobs:
               ;;
           esac
 
-      - name: Export DB host/port (service container IP)
+      - name: Determine DB host/port for published ports (Option 1)
         shell: bash
         run: |
           set -euxo pipefail
           
-          DB_HOST="$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' '${{ job.services.db.id }}')"
-          echo "Resolved DB_HOST=${DB_HOST}"
+          # If steps run inside a container, localhost is the *job container*.
+          # Use the default gateway (Docker host) to reach published ports.
+          if [ -f /.dockerenv ]; then
+            DB_HOST="$(ip route | awk '/default/ {print $3; exit}')"
+          else
+            DB_HOST="127.0.0.1"
+          fi
           
-          case "${DB_ENGINE}" in
-            postgres) DB_PORT=5432 ;;
-            mysql|mariadb) DB_PORT=3306 ;;
-            *) echo "Unknown DB_ENGINE=${DB_ENGINE}"; exit 1 ;;
-          esac
+          DB_PORT="${{ matrix.db.port }}"
           
-          echo "COMANAGE_REGISTRY_DATABASE_HOST=${DB_HOST}" >> "$GITHUB_ENV"
-          echo "COMANAGE_REGISTRY_DATABASE_PORT=${DB_PORT}" >> "$GITHUB_ENV"
+          echo "Using DB host=${DB_HOST} port=${DB_PORT} engine=${DB_ENGINE}"
+
+          {
+            echo "COMANAGE_REGISTRY_DATABASE_HOST=${DB_HOST}"
+            echo "COMANAGE_REGISTRY_DATABASE_PORT=${DB_PORT}"
+          } >> "$GITHUB_ENV"
 
-      - name: Smoke test DB TCP port
+      - name: Smoke test DB TCP connectivity (from the job environment)
         shell: bash
         run: |
           set -euxo pipefail
           php -r '
             $h=getenv("COMANAGE_REGISTRY_DATABASE_HOST"); $p=(int)getenv("COMANAGE_REGISTRY_DATABASE_PORT");
             $fp=@fsockopen($h,$p,$errno,$errstr,5);
-            if(!$fp){fwrite(STDERR,"TCP connect failed: $errno $errstr\n"); exit(1);}
+            if(!$fp){fwrite(STDERR,"TCP connect failed to $h:$p: $errno $errstr\n"); exit(1);}
             fclose($fp);
             echo "TCP connect OK to $h:$p\n";
           '
 
-      - name: Create local/config/database.php placeholder
+      - name: Create local/config/database.php placeholder (optional)
         shell: bash
         run: |
           set -euxo pipefail
-          cd "${COMANAGE_REGISTRY_DIR}"/local/config
-          sudo touch database.php
-          sudo chown www-data:www-data database.php
-          sudo tee "database.php" > /dev/null <<'EOF'
+          cd "${COMANAGE_REGISTRY_DIR}/local/config"
+          sudo mkdir -p .
+          sudo tee database.php > /dev/null <<'PHP'
           <?php
-          // Placeholder: actual connection is configured dynamically by tests/bootstrap.php via Testcontainers
+          // Intentionally empty for CI: tests/bootstrap.php configures the 'test' datasource via env vars.
           return [];
-          EOF
+          PHP
+          sudo chown www-data:www-data database.php || true
 
       - name: Show working directory
-        shell: bash
-        run: |
-          tree -L 3 "${COMANAGE_REGISTRY_DIR}"
-
-      - name: Debug DB connectivity
         shell: bash
         run: |
           set -euxo pipefail
-          echo "Host=$COMANAGE_REGISTRY_DATABASE_HOST Port=$COMANAGE_REGISTRY_DATABASE_PORT Engine=$DB_ENGINE"
-          getent hosts "$COMANAGE_REGISTRY_DATABASE_HOST" || true
+          tree -L 3 "${COMANAGE_REGISTRY_DIR}"
 
-      - name: Run PHPUnit (DB_ENGINE=${{ matrix.db_engine }})
+      - name: Run PHPUnit (DB_ENGINE=${{ matrix.db.engine }})
         shell: bash
         working-directory: /srv/comanage-registry/app
         run: |
           set -euxo pipefail
-          cd "${COMANAGE_REGISTRY_DIR}"/app
-          DB_ENGINE="${DB_ENGINE}" vendor/bin/phpunit --testsuite app
\ No newline at end of file
+          echo "DB_ENGINE=${DB_ENGINE}"
+          echo "COMANAGE_REGISTRY_DATABASE_HOST=${COMANAGE_REGISTRY_DATABASE_HOST}"
+          echo "COMANAGE_REGISTRY_DATABASE_PORT=${COMANAGE_REGISTRY_DATABASE_PORT}"
+          vendor/bin/phpunit --testsuite app
\ No newline at end of file