diff --git a/.github/workflows/build-push-image.yml b/.github/workflows/build-push-image.yml
index 1de3954..ffc924e 100644
--- a/.github/workflows/build-push-image.yml
+++ b/.github/workflows/build-push-image.yml
@@ -48,6 +48,15 @@ on:
         description: Push the image after building.
         type: boolean
         default: true
+      pre-pull:
+        description: >-
+          Whitespace-separated images to `docker pull` before building. Needed for a
+          `FROM` that lives on the plain-HTTP local registry: this daemon's builder
+          resolves FROM metadata over HTTPS regardless of `insecure-registries`
+          (observed on Synology's moby), but it prefers a locally-present image — and
+          `docker pull` goes through the daemon's insecure-aware, authenticated path.
+        type: string
+        default: ""
       tags:
         description: >-
           docker/metadata-action tag rules. The default tags `latest` on the default
@@ -78,6 +87,16 @@ jobs:
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
+      # After the login on purpose: the pulls may need the registry credentials.
+      - name: Pre-pull base images
+        if: inputs.pre-pull != ''
+        env:
+          PRE_PULL: ${{ inputs.pre-pull }}
+        run: |
+          for image in $PRE_PULL; do
+            docker pull "$image"
+          done
+
       - id: meta
         uses: docker/metadata-action@v6
         with:
diff --git a/docs/ci-runners/design.md b/docs/ci-runners/design.md
index 2fddd8b..b32806e 100644
--- a/docs/ci-runners/design.md
+++ b/docs/ci-runners/design.md
@@ -246,6 +246,13 @@ registry sync (Secrets §1) already pushes.
 - With the docker driver, the daemon's build cache is no longer discarded with the builder
   container. `docker builder prune` is the relief valve when it grows; wiring it into
   Watchtower's maintenance/pruning story is future work.
+- A `FROM` on the plain-HTTP registry fails under the docker driver with "server gave
+  HTTP response to HTTPS client" even when `insecure-registries` is configured: the
+  daemon-embedded BuildKit's `FROM`-metadata resolver ignores that setting (observed on
+  Synology's moby 24.0.2; the classic pull/push paths honor it fine). BuildKit does
+  resolve a locally-present image without touching the network, so the reusable
+  workflow's `pre-pull` input — a `docker pull` through the daemon's insecure-aware,
+  authenticated path before the build — is the fix for private base images.
 - Runners on small hosts will not reach GitHub-hosted speeds even once the snapshotter is
   right — `exporting layers` is mostly gzip on however few cores the box has. That is not
   a bug to go hunting for.