diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index fdf77d9..e76f2a5 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -237,6 +237,12 @@ jobs:
           curl -fsSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
           chmod +x /usr/local/bin/kubectl
 
+      - name: Rewrite kubeconfig for runner-reachable API
+        working-directory: terraform
+        run: |
+          PRIMARY_IP=$(terraform output -raw primary_control_plane_ip)
+          sed -i "s#https://k8s-cluster-cp-1\.[^:]*:6443#https://${PRIMARY_IP}:6443#g" ../outputs/kubeconfig
+
       - name: Bootstrap Flux source and reconciliation graph
         env:
           KUBECONFIG: outputs/kubeconfig