diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 9910e1a..6293f10 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -4,23 +4,25 @@ when:
 matrix:
   include:
     # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
     - DISTRO: alma9
       IMAGE: almalinux9
-      BASE_IMAGE: "docker.io/almalinux:9"
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 
 steps:
   - name: build
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
       target: image
       dry_run: true
       build_args:
         BASE_IMAGE: "${BASE_IMAGE}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
     backend_options:
       kubernetes:
         serviceAccountName: default
diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
index 78d8274..82ad952 100644
--- a/.woodpecker/docker.yaml
+++ b/.woodpecker/docker.yaml
@@ -5,23 +5,24 @@ when:
 matrix:
   include:
     # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
     - DISTRO: alma9
       IMAGE: almalinux9
-      BASE_IMAGE: "docker.io/almalinux:9"
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 
 steps:
   - name: docker
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
       target: image
       build_args:
         BASE_IMAGE: "${BASE_IMAGE}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - "${CI_COMMIT_TAG##v}"
         - latest
diff --git a/ci/check-distros.sh b/ci/check-distros.sh
index 8ac5ccd..838475b 100755
--- a/ci/check-distros.sh
+++ b/ci/check-distros.sh
@@ -14,6 +14,25 @@ for d in distros/*/; do
   done
   for wf in "${WORKFLOWS[@]}"; do
     grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; }
+
+    # A matrix entry that restates a distro.env key must not drift from it — a stale
+    # BASE_IMAGE here silently overrides distro.env for every CI build.
+    while IFS='=' read -r k v; do
+      [ -n "$k" ] || continue
+      grep -q "^${k}=" "${d}distro.env" || continue
+      ev=$(sed -n "s/^${k}=//p" "${d}distro.env" | head -1 | sed 's/^"//;s/"$//')
+      [ "$v" = "$ev" ] || { echo "${wf}: matrix ${k}=\"${v}\" for ${n} disagrees with ${d}distro.env (\"${ev}\")"; fail=1; }
+    done <<EOF
+$(awk -v d="$n" '
+  $0 ~ "^[[:space:]]*-[[:space:]]+DISTRO:[[:space:]]*"d"[[:space:]]*$" { inb=1; next }
+  inb && /^[[:space:]]*-/ { inb=0 }
+  inb && match($0, /^[[:space:]]+[A-Z_]+:/) {
+    k=$1; sub(/:$/,"",k)
+    v=$0; sub(/^[[:space:]]*[A-Z_]+:[[:space:]]*/,"",v); gsub(/^"|"$/,"",v)
+    print k "=" v
+  }
+' "$wf")
+EOF
   done
 done