diff --git a/apps/production/turn-secret-rotation.yaml b/apps/production/turn-secret-rotation.yaml
index 95802f4..2f7101b 100644
--- a/apps/production/turn-secret-rotation.yaml
+++ b/apps/production/turn-secret-rotation.yaml
@@ -24,6 +24,13 @@ spec:
             app.kubernetes.io/component: rotation
         spec:
           restartPolicy: OnFailure
+          # Public-internet reachability to the Gitea host has been flaky (see Issue #41);
+          # both servers share a private Hetzner network. hostAliases (unlike the node-level
+          # /etc/hosts fix used for image pulls) is actually honored by in-pod processes.
+          hostAliases:
+            - ip: "10.0.0.3"
+              hostnames:
+                - "rohana.axion1337.de"
           containers:
             - name: rotate
               image: rohana.axion1337.de/sorb/axion-secret-rotation:v1