diff --git a/templates/3d-printing/main.tf b/templates/3d-printing/main.tf
index 74af2c9..644fea8 100644
--- a/templates/3d-printing/main.tf
+++ b/templates/3d-printing/main.tf
@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name
diff --git a/templates/cobol/main.tf b/templates/cobol/main.tf
index 9194ab1..10dc99d 100644
--- a/templates/cobol/main.tf
+++ b/templates/cobol/main.tf
@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name
diff --git a/templates/default/main.tf b/templates/default/main.tf
index 9e4a74e..0eb942c 100644
--- a/templates/default/main.tf
+++ b/templates/default/main.tf
@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name
diff --git a/templates/python/main.tf b/templates/python/main.tf
index c3c4327..a0f03ff 100644
--- a/templates/python/main.tf
+++ b/templates/python/main.tf
@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name
diff --git a/templates/ttrpg/main.tf b/templates/ttrpg/main.tf
index dc49ae8..0b21490 100644
--- a/templates/ttrpg/main.tf
+++ b/templates/ttrpg/main.tf
@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name
diff --git a/templates/web/main.tf b/templates/web/main.tf
index 9ee34c6..2b675b7 100644
--- a/templates/web/main.tf
+++ b/templates/web/main.tf
@@ -226,6 +226,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name