diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 33784015..bc522b54 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -19,7 +19,9 @@ on:
       - 'Dockerfile'
       - 'docker-compose.yml'
       - 'docker-entrypoint-initdb.d/**'
+      - 'scripts/pg-common.sh'
       - 'scripts/test-e2e-docker.sh'
+      - 'src/ssrf.rs'
       - 'tests/test_docker_runner.py'
       - 'Cargo.toml'
       - 'Cargo.lock'
diff --git a/Dockerfile b/Dockerfile
index 8c7be40f..f95849cb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -77,7 +77,7 @@ RUN echo "shared_preload_libraries = 'pg_durable'" >> /usr/share/postgresql/post
     echo "pg_durable.worker_role = 'postgres'" >> /usr/share/postgresql/postgresql.conf.sample && \
     echo "pg_durable.enable_superuser_instances = on" >> /usr/share/postgresql/postgresql.conf.sample && \
     echo "pg_durable.http_security = 'restricted'" >> /usr/share/postgresql/postgresql.conf.sample && \
-    echo "pg_durable.http_allowed_domains = '*.blob.core.windows.net,*.blob.storage.azure.net,*.queue.core.windows.net,*.table.core.windows.net,*.file.core.windows.net,*.azurewebsites.net,*.azure-api.net,*.documents.azure.com,*.servicebus.windows.net,*.openai.azure.com,*.cognitiveservices.azure.com,*.vault.azure.net,*.redis.cache.windows.net,*.database.windows.net,*.kusto.windows.net,*.azurefd.net,*.azureedge.net,*.azure-devices.net,*.trafficmanager.net,*.cloudapp.azure.com,api.github.com,httpbingo.org'" >> /usr/share/postgresql/postgresql.conf.sample && \
+    echo "pg_durable.http_allowed_domains = '*.blob.core.windows.net,*.blob.storage.azure.net,*.queue.core.windows.net,*.table.core.windows.net,*.file.core.windows.net,*.azurewebsites.net,*.azurecontainerapps.io,*.azurecontainer.io,*.azure-api.net,*.documents.azure.com,*.servicebus.windows.net,*.openai.azure.com,*.cognitiveservices.azure.com,*.services.ai.azure.com,*.vault.azure.net,*.redis.cache.windows.net,*.database.windows.net,*.kusto.windows.net,*.azurefd.net,*.azureedge.net,*.azure-devices.net,*.trafficmanager.net,*.cloudapp.azure.com,api.github.com,httpbingo.org'" >> /usr/share/postgresql/postgresql.conf.sample && \
     echo "logging_collector = on" >> /usr/share/postgresql/postgresql.conf.sample && \
     echo "log_directory = 'log'" >> /usr/share/postgresql/postgresql.conf.sample && \
     echo "log_filename = 'postgresql.log'" >> /usr/share/postgresql/postgresql.conf.sample && \
diff --git a/tests/test_docker_runner.py b/tests/test_docker_runner.py
index 808fe6fc..e593504c 100644
--- a/tests/test_docker_runner.py
+++ b/tests/test_docker_runner.py
@@ -7,6 +7,7 @@
 import json
 import os
 from pathlib import Path
+import re
 import shutil
 import subprocess
 import sys
@@ -82,6 +83,22 @@ def run_runner(self, names, **environment):
         tests = [args[args.index("-f") + 1] for args in calls if args[0] == "exec" and "-f" in args]
         return result, calls, tests
 
+    def test_image_http_allowlist_matches_local_runner(self):
+        common = (ROOT / "scripts" / "pg-common.sh").read_text(encoding="utf-8")
+        dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
+        local_match = re.search(r"PG_DURABLE_TEST_HTTP_DOMAINS='([^']*)'", common)
+        docker_match = re.search(r"pg_durable\.http_allowed_domains\s*=\s*'([^']*)'", dockerfile)
+        self.assertIsNotNone(
+            local_match, "Missing quoted PG_DURABLE_TEST_HTTP_DOMAINS in scripts/pg-common.sh"
+        )
+        self.assertIsNotNone(
+            docker_match, "Missing quoted pg_durable.http_allowed_domains in Dockerfile"
+        )
+        self.assertCountEqual(
+            [domain.strip() for domain in docker_match.group(1).split(",")],
+            [domain.strip() for domain in local_match.group(1).split(",")],
+        )
+
     def test_fixed_image_skips_every_local_special_phase(self):
         local = (ROOT / "scripts" / "test-e2e-local.sh").read_text()
         # Read only the phase classifier without running its server-management code.