diff --git a/.gitea/workflows/qa-build.yml b/.gitea/workflows/qa-build.yml
index db2659b..59c126e 100644
--- a/.gitea/workflows/qa-build.yml
+++ b/.gitea/workflows/qa-build.yml
@@ -70,19 +70,35 @@ jobs:
 
       - name: Wait for the build daemon
         run: |
-          # A privileged service container is the one runner capability this
-          # workflow cannot verify in advance. Fail here with an explanation
-          # rather than at `docker build` with a connection refused.
-          for i in $(seq 1 30); do
+          # dind needs a privileged service container, which is a runner-wide
+          # setting this workflow cannot check in advance. The NAS is also slow
+          # to start one, so allow well over the observed time before giving up.
+          for i in $(seq 1 90); do
             if docker info >/dev/null 2>&1; then
               echo "Build daemon reachable after ${i}s."
               exit 0
             fi
             sleep 1
           done
-          echo "::error::No Docker daemon at $DOCKER_HOST after 30s."
-          echo "The dind service needs privileged containers. If the runner"
-          echo "forbids them, this workflow cannot build without host socket access."
+
+          echo "::error::No Docker daemon at $DOCKER_HOST after 90s."
+          echo ""
+          # These two cases look identical from the failing step but have
+          # completely different fixes, so name which one it is.
+          if getent hosts docker >/dev/null 2>&1; then
+            echo "The 'docker' service host resolves, so the container exists but"
+            echo "dockerd is not accepting connections on 2375. Check that"
+            echo "DOCKER_TLS_CERTDIR is empty, so dind serves plain TCP rather"
+            echo "than TLS on 2376."
+          else
+            echo "The 'docker' service host does not resolve, so the service"
+            echo "container never started. This is what act_runner does when it"
+            echo "refuses a privileged container: it allocates an ID, creation"
+            echo "fails, and the job continues with nothing listening."
+            echo ""
+            echo "Set 'container.privileged: true' in the act_runner config.yaml"
+            echo "and restart the runner. Check the runner's own logs to confirm."
+          fi
           exit 1
 
       - name: Record what is being built