diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 140813c..c93a351 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -32,9 +32,14 @@ jobs:
 
       - name: Configure kubectl
         run: |
+          if [ -z "${{ secrets.KUBECONFIG }}" ]; then
+            echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080."
+            exit 1
+          fi
           mkdir -p $HOME/.kube
           echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
           chmod 600 $HOME/.kube/config
+          kubectl config current-context
 
       - name: Server-side dry-run of full kustomization
         run: |
@@ -65,9 +70,14 @@ jobs:
 
       - name: Configure kubectl
         run: |
+          if [ -z "${{ secrets.KUBECONFIG }}" ]; then
+            echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080."
+            exit 1
+          fi
           mkdir -p $HOME/.kube
           echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
           chmod 600 $HOME/.kube/config
+          kubectl config current-context
 
       - name: Apply kustomization
         run: |