diff --git a/.gitea/workflows/gates.yml b/.gitea/workflows/gates.yml
index ca485001..4a6f4349 100644
--- a/.gitea/workflows/gates.yml
+++ b/.gitea/workflows/gates.yml
@@ -228,8 +228,16 @@ jobs:
 
           repo = os.environ.get("GITHUB_REPOSITORY", "?")
           sha  = os.environ.get("GITHUB_SHA", "?")
-          run  = os.environ.get("GITHUB_RUN_NUMBER", "?")
-          srv  = os.environ.get("GITHUB_SERVER_URL", "https://gitea.dooplex.hu")
+          # R-1135: the link is for a PERSON, so it is the public address and the run ID.
+          # NOT GITHUB_SERVER_URL: the runner registers at the in-cluster address, so that variable
+          # reads http://gitea.gitea-system.svc.cluster.local:3000, which nobody outside the cluster
+          # can open (forced-test mail, job 1997). NOT GITHUB_RUN_NUMBER: Gitea 1.26 reads
+          # /actions/runs/<n> as a run id first, so a run number that is also an older run's id
+          # opens THAT run (measured 2026-10-18: felhom.eu /actions/runs/1116 opened the run whose
+          # id is 1116 = run number 613). The link is printed too, so the job log carries it.
+          run  = os.environ.get("GITHUB_RUN_ID", "?")
+          srv  = "https://gitea.dooplex.hu"
+          print("ALARM-LINK %s/%s/actions/runs/%s" % (srv, repo, run))
 
           # R-265: how long the run took, so a reap is self-identifying. An honest gate failure
           # lands in well under a minute; a multi-minute figure means the job hit its own timeout
diff --git a/scripts/CHANGELOG.md b/scripts/CHANGELOG.md
index 0648a411..7ff8782c 100644
--- a/scripts/CHANGELOG.md
+++ b/scripts/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 2026-10-18 — CI workflow: the failure mail links the public run page, by run id (R-1135)
+
+`.gitea/workflows/gates.yml`, the alarm step: the mail's run link is now `https://gitea.dooplex.hu/<repo>/actions/runs/<run id>`.
+It used `GITHUB_SERVER_URL`, which on this runner is the in-cluster address (`http://gitea.gitea-system.svc.cluster.local:3000`,
+the address the runner registers at), so nobody outside the cluster could open it. It also used the run NUMBER, and
+Gitea 1.26 reads `/actions/runs/<n>` as a run id first: a number that is also an older run's id opened that other run
+(measured 2026-10-18: `felhom.eu/actions/runs/1116` opened run id 1116, run number 613). It now uses `GITHUB_RUN_ID` and
+prints the link (`ALARM-LINK …`) into the job log. Same change in all four repos' workflows.
+
 ## 2026-10-18 — felhom-host-install.sh 1.34.0 (tag `installer-v1.34.0`, published on the operator's yes 2026-10-18): step 4b vaults FIRST, then sets the password (R-1145); the host key off curl's argv; the harness is a gate (R-1146)
 
 **1.34.0 carries every untagged entry below it since 1.33.0:** this one, `--rotate-recovery-only` (R-1141) and the