diff --git a/.gitea/workflows/telegraf-snmp.yaml b/.gitea/workflows/telegraf-snmp.yaml
index bec7692..44bbbe0 100644
--- a/.gitea/workflows/telegraf-snmp.yaml
+++ b/.gitea/workflows/telegraf-snmp.yaml
@@ -31,6 +31,19 @@ jobs:
         with:
           driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest
 
+      - name: Debug TLS in BuildKit
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "=== Builder: $BUILDER ==="
+          docker exec "$BUILDER" sh -c '
+            echo "=== Certs in bundle ==="
+            grep -c "BEGIN CERTIFICATE" /etc/ssl/certs/ca-certificates.crt 2>/dev/null || echo "bundle not found"
+            echo "=== TLS test to harbor.lan ==="
+            wget -qO /dev/null https://harbor.lan/ 2>&1 && echo "TLS OK" || echo "TLS FAILED"
+            echo "=== Last cert in bundle ==="
+            awk "/BEGIN CERT/{p=1} p{print} /END CERT/{p=0}" /etc/ssl/certs/ca-certificates.crt | tail -20
+          '
+
       - name: Build and push image
         uses: docker/build-push-action@v6
         with: