diff --git a/.github/workflows/validate-charts.yml b/.github/workflows/validate-charts.yml
index bd53e27..010b0eb 100644
--- a/.github/workflows/validate-charts.yml
+++ b/.github/workflows/validate-charts.yml
@@ -288,8 +288,31 @@ jobs:
     steps:
       - name: "Checkout Repository"
         uses: actions/checkout@v7
+      - name: "PROBE egress from the job container (throwaway branch only)"
+        run: |
+          set +e
+          echo "### resolv.conf"; cat /etc/resolv.conf
+          echo "### DNS"
+          for h in get.helm.sh api.github.com raw.githubusercontent.com registry-1.docker.io ghcr.io; do
+            printf '%-28s ' "$h"; getent hosts "$h" || echo "DNS FAILED"
+          done
+          echo "### HTTPS from the JOB container"
+          for u in https://get.helm.sh/helm-v3.18.4-linux-amd64.tar.gz https://api.github.com/ https://raw.githubusercontent.com/ https://registry-1.docker.io/v2/ https://ghcr.io/v2/; do
+            printf '%-62s ' "$u"
+            curl -sS -o /dev/null -m 20 -w 'http=%{http_code} dns=%{time_namelookup}s conn=%{time_connect}s total=%{time_total}s\n' "$u" || echo "CURL FAILED"
+          done
+          echo "### egress of the DOCKER DAEMON (separate network path)"
+          docker pull --quiet alpine:3.20 && echo "docker pull alpine OK" || echo "docker pull alpine FAILED"
+          docker pull --quiet ghcr.io/k3d-io/k3d-proxy:5.9.0 && echo "docker pull ghcr OK" || echo "docker pull ghcr FAILED"
+          echo "### cgroups (the thing that was fixed)"
+          docker info --format 'server={{.ServerVersion}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} storage={{.Driver}}'
+          docker info 2>&1 | grep -iE "rootless|WARNING" || echo "(no rootless/WARNING lines)"
+          echo "### done - this step never fails on purpose"
+          exit 0
       - name: "Install Helm"
         uses: azure/setup-helm@v5
+        with:
+          version: v3.18.4
       # freesailarr is the one chart whose install-test needs credentials:
       # without a real Wireguard key gluetun never completes a handshake, and
       # behind its kill switch not a single app container becomes Ready. The key