diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 3524a4d..59202a1 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -262,11 +262,16 @@ jobs:
           }
           EOF
 
-          cid=$(docker run -d --name nxdns-smoke \
+          # No bind mount: the runner talks to the daemon over a mounted
+          # socket, so a -v path would resolve on the docker host (where the
+          # workspace does not exist) and mount an empty directory over
+          # /etc/nxdns. docker cp streams the file through the socket instead.
+          cid=$(docker create --name nxdns-smoke \
             -p 127.0.0.1:8080:8080 \
-            -v "$PWD/etc-nxdns:/etc/nxdns:ro" \
             nxdns:ci)
           trap 'docker rm -f nxdns-smoke >/dev/null 2>&1 || true' EXIT
+          docker cp etc-nxdns/config.zon nxdns-smoke:/etc/nxdns/config.zon
+          docker start nxdns-smoke
 
           # The published port works when the job runs on the docker host or in
           # DinD; the container IP covers a runner that shares the daemon over