diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0bbaaf8..875fb33 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,8 +28,9 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          # Use debug build for faster startup in CI
-          RUST_LOG=info cargo run -p socktop_agent -- -p 3000 &
+          # Start the already-built release binary to avoid rebuild delays
+          # Force TLS off for this probe
+          RUST_LOG=info SOCKTOP_ENABLE_SSL=0 ./target/release/socktop_agent -p 3000 > agent.log 2>&1 &
           AGENT_PID=$!
           echo "AGENT_PID=$AGENT_PID" >> $GITHUB_ENV
           # Wait for port 3000 to accept connections (30s max)
@@ -40,6 +41,13 @@ jobs:
             fi
             sleep 0.5
           done
+          if ! bash -lc "</dev/tcp/127.0.0.1/3000" &>/dev/null; then
+            echo "--- agent.log (tail) ---"
+            tail -n 200 agent.log || true
+            echo "--- lsof/netstat ---"
+            (command -v ss >/dev/null && ss -ltnp || netstat -ltnp) || true
+            exit 1
+          fi
       - name: Run WS probe test (Ubuntu)
         if: matrix.os == 'ubuntu-latest'
         shell: bash
@@ -57,14 +65,26 @@ jobs:
         if: matrix.os == 'windows-latest'
         shell: pwsh
         run: |
-          $p = Start-Process -FilePath "cargo" -ArgumentList "run -p socktop_agent -- -p 3000" -PassThru
+          # Start the already-built release binary to avoid rebuild delays
+          # Force TLS off for this probe
+          $env:SOCKTOP_ENABLE_SSL = "0"
+          $out = Join-Path $PWD "agent.out.txt"
+          $err = Join-Path $PWD "agent.err.txt"
+          $p = Start-Process -FilePath "${PWD}\\target\\release\\socktop_agent.exe" -ArgumentList "-p 3000" -RedirectStandardOutput $out -RedirectStandardError $err -PassThru -NoNewWindow
           echo "AGENT_PID=$($p.Id)" | Out-File -FilePath $env:GITHUB_ENV -Append
           $ready = $false
-          for ($i = 0; $i -lt 60; $i++) {
+          for ($i = 0; $i -lt 120; $i++) {
             if (Test-NetConnection -ComputerName 127.0.0.1 -Port 3000 -InformationLevel Quiet) { $ready = $true; break }
             Start-Sleep -Milliseconds 500
           }
-          if (-not $ready) { Write-Error "agent did not become ready" }
+          if (-not $ready) {
+            Write-Warning "TCP connect to (127.0.0.1 : 3000) failed"
+            if (Test-Path $out) { Write-Host "--- agent.out (tail) ---"; Get-Content $out -Tail 200 }
+            if (Test-Path $err) { Write-Host "--- agent.err (tail) ---"; Get-Content $err -Tail 200 }
+            Write-Host "--- netstat ---"
+            netstat -ano | Select-String ":3000" | ForEach-Object { $_.Line }
+            Write-Error "agent did not become ready"
+          }
       - name: Run WS probe test (Windows)
         if: matrix.os == 'windows-latest'
         shell: pwsh