diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e476207..6d522ea 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -37,10 +37,44 @@ deploy_stage:
     - echo "$KUBECONFIGCONTENT" > ~/.kube/config
     - chmod 600 ~/.kube/config
   script:
-    - kubectl apply --validate=false -f manifests/stage/
+    - kubectl apply -f manifests/stage/
     - kubectl set image deployment/flask-app flask-app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA -n stage
     - kubectl rollout status deployment/flask-app -n stage
   environment:
     name: stage
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main"'
+      when: manual
+
+debug_runner_to_cluster:
+  stage: deploy
+  image: alpine:latest
+  before_script:
+    - apk add --no-cache curl busybox-extras iproute2 bind-tools
+  script:
+    - echo "=== Runner host/container info ==="
+    - hostname
+    - whoami
+
+    - echo "=== Network interfaces ==="
+    - ip addr
+
+    - echo "=== Routing table ==="
+    - ip route
+
+    - echo "=== DNS config ==="
+    - cat /etc/resolv.conf
+
+    - echo "=== Internal DNS tests ==="
+    - nslookup gitlab.internal.uia.no || true
+    - nslookup registry.internal.uia.no || true
+
+    - echo "=== GitLab/Registry connectivity ==="
+    - nc -vz -w 10 gitlab.internal.uia.no 443 || true
+    - nc -vz -w 10 registry.internal.uia.no 443 || true
+
+    - echo "=== Kubernetes API connectivity ==="
+    - nc -vz -w 10 10.225.210.169 6443 || true
+    - curl -k --connect-timeout 10 https://10.225.210.169:6443/version || true
   rules:
     - if: '$CI_COMMIT_BRANCH == "main"'