diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index af8e567..f1d2ad2 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -21,10 +21,43 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Install debug tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y dnsutils iputils-tracepath mtr-tiny netcat-openbsd
+      - name: Debug Python and SSL
+        continue-on-error: true
+        run: |
+          python -V
+          python -c "import sys, ssl; print(sys.executable); print(sys.version); print(ssl.OPENSSL_VERSION)"
+          python -m pip --version
+      - name: Debug runner egress IP
+        continue-on-error: true
+        run: |
+          curl -s https://api.ipify.org || true
+          echo
+          curl -s https://checkip.amazonaws.com || true
+          echo
+      - name: Debug endpoint reachability
+        continue-on-error: true
+        run: |
+          getent hosts api.nersc.gov || true
+          nslookup api.nersc.gov || true
+          getent ahosts api.nersc.gov || true
+          tracepath -n api.nersc.gov || true
+          mtr -u -n -rw -c 1 api.nersc.gov || true
+          for ip in $(getent ahostsv4 api.nersc.gov | awk '{print $1}' | sort -u); do
+            nc -vz -w 5 "$ip" 443 || true
+            curl -4 -Iv --connect-timeout 5 --max-time 10 --resolve api.nersc.gov:443:"$ip" https://api.nersc.gov/api/v1.2/meta/changelog || true
+          done
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           if [ -f pyproject.toml ]; then pip install -e .[test]; fi
+      - name: Debug installed packages
+        continue-on-error: true
+        run: |
+          python -m pip freeze
       - name: Test with pytest
         run: |
           pytest -m public