diff --git a/.gitea/workflows/runner-smoke.yml b/.gitea/workflows/runner-smoke.yml
new file mode 100644
index 00000000..00b5d63c
--- /dev/null
+++ b/.gitea/workflows/runner-smoke.yml
@@ -0,0 +1,29 @@
+name: Gitea Runner Smoke Test
+on:
+  workflow_dispatch:
+  push:
+    branches: [runner/gitea-smoke]
+
+jobs:
+  smoke:
+    runs-on: [ubuntu-latest, bytelyst, hostinger]
+    steps:
+      - name: Print runtime
+        run: |
+          echo "host=$(hostname) user=$(whoami)"
+          grep '^PRETTY_NAME=' /etc/os-release || true
+      - name: Node and npm
+        run: node --version && npm --version
+      - name: Install pinned pnpm
+        run: |
+          npm install -g pnpm@9.12.0
+          pnpm --version
+      - name: Check Gitea reachability from container
+        run: |
+          echo "Gitea health from runner container:"
+          curl -s -o /dev/null -w "  via host.docker.internal:3300 -> %{http_code}\n" http://host.docker.internal:3300/
+          curl -s http://host.docker.internal:3300/api/v1/version | head -c 200; echo
+      - name: Confirm token is not mounted in smoke workflow
+        run: |
+          test ! -e /run/secrets/gitea_npm_token
+          echo "PASS: publish token is not mounted in smoke workflow"