diff --git a/.gitea/workflows/build_push.yml b/.gitea/workflows/build_push.yml
index e1de732..99bf4c5 100644
--- a/.gitea/workflows/build_push.yml
+++ b/.gitea/workflows/build_push.yml
@@ -118,9 +118,56 @@ jobs:
           # cluster-admin-equivalent, so it should not be readable by
           # anything else on the runner.
           install -m 600 /dev/null $HOME/.kube/config
-          echo "${{ secrets.KUBEC_CONFIG_BUILDX }}" > $HOME/.kube/config
+          echo "${{ secrets.KUBEC_CONFIG_BUILDX_NEW_2 }}" > $HOME/.kube/config
           chmod 600 $HOME/.kube/config
 
+      - name: Verify the cluster is reachable
+        run: |
+          # Fail fast, and with a useful message, if the kubeconfig cannot
+          # talk to the API server.
+          #
+          # The certificate-authority-data inside the kubeconfig is the k3s
+          # server CA.  If the cluster's CA has been rotated since the secret
+          # was created, kubectl fails with:
+          #   tls: failed to verify certificate: x509: certificate signed by
+          #   unknown authority
+          # which is a confusing way to learn that a secret is stale.
+          if kubectl version --request-timeout=15s >/dev/null 2>&1; then
+            echo "cluster reachable"
+            exit 0
+          fi
+
+          echo "the kubeconfig could not verify the API server - refreshing the CA"
+
+          # The API server publishes its own CA at /cacerts.  Fetch it over an
+          # insecure connection - we cannot verify it yet, that is the problem
+          # being solved - and pin it explicitly.  This makes the deploy
+          # self-healing after a CA rotation, instead of needing the secret
+          # to be regenerated by hand.
+          SERVER=$(kubectl config view --raw -o jsonpath='{.clusters[0].cluster.server}')
+          echo "server: $SERVER"
+          curl -sk "$SERVER/cacerts" -o $HOME/.kube/ca.crt
+
+          if [ ! -s $HOME/.kube/ca.crt ]; then
+            echo "ERROR: could not fetch the cluster CA from $SERVER/cacerts"
+            exit 1
+          fi
+
+          kubectl config set-cluster default \
+            --embed-certs=true \
+            --certificate-authority=$HOME/.kube/ca.crt >/dev/null
+          rm -f $HOME/.kube/ca.crt
+
+          if kubectl version --request-timeout=15s >/dev/null 2>&1; then
+            echo "cluster reachable after refreshing the CA"
+            exit 0
+          fi
+
+          echo "ERROR: cannot reach the cluster API server even with a refreshed CA."
+          echo "  The kubeconfig in the KUBEC_CONFIG_BUILDX_NEW_2 secret may be"
+          echo "  stale or invalid, and needs regenerating."
+          exit 1
+
       - name: Install kubectl
         run: |
           # Skip the whole apt dance if the runner already has a kubectl.