diff --git a/templates/cache_cleanup.gitlab-ci.yml b/templates/cache_cleanup.gitlab-ci.yml
index 156f66808dc0a385906111d68903910246a3bded..42ac871032ccdf35b94ec499e314247382561347 100644
--- a/templates/cache_cleanup.gitlab-ci.yml
+++ b/templates/cache_cleanup.gitlab-ci.yml
@@ -33,3 +33,41 @@ include:
     - du -h -d 1 /cache
     - find "/cache" -maxdepth 1 -wholename "$CLEANUP_PATH_PATTERN" -mtime "+${CACHE_DAYS}"
     - find "/cache" -maxdepth 1 -wholename "$CLEANUP_PATH_PATTERN" -mtime "+${CACHE_DAYS}" -exec rm -rf {} \;
+
+# =============================================================================
+# Stale Cache Cleanup Template
+# =============================================================================
+# Checks for and removes stale cache directories with permission issues.
+# Use this before operations that need write access to cache directories.
+#
+# Required variables:
+#   CACHE_DIR: Path to cache directory to check (default: /cache/data)
+#
+# Usage:
+#   before_script:
+#     - !reference [.cleanup_stale_cache, script]
+# =============================================================================
+.cleanup_stale_cache:
+  script:
+    - |
+      CACHE_PATH="${CACHE_DIR:-/cache/data}"
+      if [[ -d "$CACHE_PATH" ]]; then
+        # Test if we can write to the cache directory
+        if ! touch "$CACHE_PATH/.write_test" 2>/dev/null; then
+          echo "Stale cache detected at $CACHE_PATH (permission issues)"
+          echo "Attempting cleanup..."
+          # Try with sudo first, then without
+          if sudo rm -rf "$CACHE_PATH" 2>/dev/null; then
+            echo "Cleaned up stale cache with sudo"
+          elif rm -rf "$CACHE_PATH" 2>/dev/null; then
+            echo "Cleaned up stale cache"
+          else
+            echo "WARNING: Could not remove stale cache at $CACHE_PATH"
+          fi
+        else
+          rm -f "$CACHE_PATH/.write_test"
+          echo "Cache directory $CACHE_PATH is writable"
+        fi
+      else
+        echo "Cache directory $CACHE_PATH does not exist (will be created as needed)"
+      fi
diff --git a/templates/haf_app_testing.gitlab-ci.yml b/templates/haf_app_testing.gitlab-ci.yml
index 46c31a28294f28551d99a12a92ce49ac9e574af4..74bfbfd275b8cef5bcc2d65e569e68055ebd896f 100644
--- a/templates/haf_app_testing.gitlab-ci.yml
+++ b/templates/haf_app_testing.gitlab-ci.yml
@@ -1287,6 +1287,8 @@ include:
 
 # Wait for PostgREST to be ready
 # Requires: PGRST_HOST or docker-compose with 'postgrest' service
+# Note: In DinD, curl may resolve hostnames differently than other tools.
+#       This template handles DNS inconsistencies by using getent for resolution.
 .haf_app_wait_for_postgrest:
   script:
     - |
@@ -1296,11 +1298,24 @@ include:
       WAIT_INTERVAL=3
       ELAPSED=0
 
-      # Determine connection method
-      PGRST_URL="${PGRST_HOST:-http://postgrest:3000}"
+      # Determine connection URL
+      if [[ -n "${PGRST_HOST:-}" ]]; then
+        PGRST_URL="${PGRST_HOST}"
+      else
+        # In DinD, curl may resolve 'docker' hostname to wrong IP.
+        # Use getent to get the correct IP for reliable connections.
+        DOCKER_IP=$(getent hosts docker 2>/dev/null | awk '{print $1}' | head -1)
+        if [[ -n "$DOCKER_IP" ]]; then
+          PGRST_URL="http://${DOCKER_IP}:3000"
+          echo "Using resolved Docker IP: $DOCKER_IP"
+        else
+          PGRST_URL="http://docker:3000"
+        fi
+      fi
+      echo "PostgREST URL: $PGRST_URL"
 
       while [[ $ELAPSED -lt $MAX_WAIT ]]; do
-        if curl -sf "${PGRST_URL}/" >/dev/null 2>&1; then
+        if curl -sf --max-time 5 "${PGRST_URL}/" >/dev/null 2>&1; then
           echo "PostgREST ready after ${ELAPSED}s at ${PGRST_URL}"
           break
         fi
@@ -1311,6 +1326,8 @@ include:
 
       if [[ $ELAPSED -ge $MAX_WAIT ]]; then
         echo "ERROR: PostgREST not ready after ${MAX_WAIT}s"
+        echo "Last curl attempt:"
+        curl -v --max-time 5 "${PGRST_URL}/" 2>&1 || true
         exit 1
       fi