diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index a6da167..3946f8e 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -13,15 +13,16 @@ steps:
   - name: build
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder"
       target: image
       dry_run: true
       build_args:
         BASE_IMAGE_NAME: "${BASE_IMAGE_NAME}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
     backend_options:
       kubernetes:
         serviceAccountName: default
diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
index b42a902..12b4a86 100644
--- a/.woodpecker/docker.yaml
+++ b/.woodpecker/docker.yaml
@@ -14,15 +14,15 @@ steps:
   - name: docker
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder"
       target: image
       build_args:
         BASE_IMAGE_NAME: "${BASE_IMAGE_NAME}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - "${CI_COMMIT_TAG##v}-${TAG_SUFFIX}"
     backend_options:
@@ -48,9 +48,6 @@ steps:
       build_args:
         BASE_IMAGE_NAME: "${BASE_IMAGE_NAME}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - "${CI_COMMIT_TAG##v}"
         - latest
diff --git a/ci/check-distros.sh b/ci/check-distros.sh
index 44f8e66..6948081 100755
--- a/ci/check-distros.sh
+++ b/ci/check-distros.sh
@@ -14,6 +14,25 @@ for d in distros/*/; do
   done
   for wf in "${WORKFLOWS[@]}"; do
     grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; }
+
+    # A matrix entry that restates a distro.env key must not drift from it — a stale
+    # BASE_IMAGE here silently overrides distro.env for every CI build.
+    while IFS='=' read -r k v; do
+      [ -n "$k" ] || continue
+      grep -q "^${k}=" "${d}distro.env" || continue
+      ev=$(sed -n "s/^${k}=//p" "${d}distro.env" | head -1 | sed 's/^"//;s/"$//')
+      [ "$v" = "$ev" ] || { echo "${wf}: matrix ${k}=\"${v}\" for ${n} disagrees with ${d}distro.env (\"${ev}\")"; fail=1; }
+    done <<EOF
+$(awk -v d="$n" '
+  $0 ~ "^[[:space:]]*-[[:space:]]+DISTRO:[[:space:]]*"d"[[:space:]]*$" { inb=1; next }
+  inb && /^[[:space:]]*-/ { inb=0 }
+  inb && match($0, /^[[:space:]]+[A-Z_]+:/) {
+    k=$1; sub(/:$/,"",k)
+    v=$0; sub(/^[[:space:]]*[A-Z_]+:[[:space:]]*/,"",v); gsub(/^"|"$/,"",v)
+    print k "=" v
+  }
+' "$wf")
+EOF
   done
 done