diff --git a/.gitea/workflows/python-checks.yml b/.gitea/workflows/python-checks.yml
index b1661ce..70895d5 100644
--- a/.gitea/workflows/python-checks.yml
+++ b/.gitea/workflows/python-checks.yml
@@ -60,6 +60,12 @@ jobs:
 
           # Probe the configured simple index before pip resolves dependencies.  The
           # probe deliberately prints only scheme/host/path, never URL credentials.
+          # NOTE: Gitea's PyPI package registry does not serve a browsable listing at
+          # the bare /simple/ root (only /simple/<package>/ resolves per PEP 503), so a
+          # 404 against the configured URL is expected there and is not itself a fault.
+          # This probe therefore only fails hard on auth rejection (401/403) or an
+          # unreachable/erroring host; a plain 404 is logged and deferred to pip's own
+          # resolution, which is the real signal for whether the package is installable.
           python - "$PRIVATE_INDEX_URL" <<'PY'
           import base64
           import sys
@@ -83,7 +89,16 @@ jobs:
               print(f"Private package-index probe: HTTP {error.code} at {safe_url}")
               if error.code in {401, 403}:
                   print("Authentication was rejected by the private package index.")
-              raise SystemExit(1)
+                  raise SystemExit(1)
+              if error.code == 404:
+                  print(
+                      "Bare index root returned 404; Gitea's PyPI registry does not "
+                      "serve a listing at /simple/ (only /simple/<package>/ resolves "
+                      "per PEP 503). Treating this as expected and deferring to pip's "
+                      "own dependency resolution to confirm the index actually works."
+                  )
+              else:
+                  raise SystemExit(1)
           except URLError as error:
               print(f"Private package-index probe could not reach {safe_url}: {error.reason}")
               raise SystemExit(1)