diff --git a/scripts/code-queue-cicd-dry-run-contract-test.ts b/scripts/code-queue-cicd-dry-run-contract-test.ts
index acba36e0..ab2969d8 100644
--- a/scripts/code-queue-cicd-dry-run-contract-test.ts
+++ b/scripts/code-queue-cicd-dry-run-contract-test.ts
@@ -160,6 +160,9 @@ assertCondition(ciSource.includes('options.transport === "direct-docker"'), "ci
 assertCondition(ciSource.includes('options.transport === "auto" && options.serviceId === "code-queue"'), "auto transport should select direct-docker for Code Queue artifacts");
 assertCondition(ciSource.includes("dependsOnLocalUnideskDatabase: false"), "direct-docker publish must not depend on local unidesk-database dispatch");
 assertCondition(ciSource.includes("CODE_QUEUE_BASE_IMAGE=unidesk-code-queue:d601"), "direct-docker Code Queue publish must use the warmed D601 base image");
+assertCondition(ciSource.includes("directDockerBuildNetworkArgs"), "direct-docker Code Queue publish must own scoped build network args");
+assertCondition(ciSource.includes('"--network"') && ciSource.includes('"host"'), "direct-docker Code Queue publish must use host networking for the D601 provider proxy");
+assertCondition(ciSource.includes("providerGatewayWsEgressProxyUrl") && ciSource.includes("HTTP_PROXY") && ciSource.includes("HTTPS_PROXY"), "direct-docker Code Queue publish must pass scoped provider-gateway proxy build args");
 assertCondition(ciSource.includes("code-queue-base-image-missing"), "direct-docker Code Queue publish should fail fast when the warmed base image is missing");
 assertCondition(ciSource.includes("no deploy apply, no rollout, no Code Queue restart, no active task mutation"), "direct-docker publish boundary should forbid runtime mutation");
 assertCondition(ciSource.includes("repo-owned Docker artifact publish without backend-core/database dispatch"), "ci help should describe the repo-owned direct-docker delivery path");
@@ -173,5 +176,6 @@ process.stdout.write(`${JSON.stringify({
     "prod Code Queue boundary forbids self-deploy, prod mutation, interrupt and cancel actions",
     "artifact-registry dev dry-run is non-mutating while prod remains unsupported",
     "ci publish-user-service exposes direct-docker Code Queue artifact publish without local database dispatch",
+    "direct-docker Code Queue artifact publish uses scoped provider-gateway build proxy args",
   ],
 }, null, 2)}\n`);
diff --git a/scripts/src/ci.ts b/scripts/src/ci.ts
index a205e8c0..05137ad5 100644
--- a/scripts/src/ci.ts
+++ b/scripts/src/ci.ts
@@ -1524,6 +1524,39 @@ function buildContextForService(serviceId: string, dockerfile: string): string {
   return serviceId === "claudeqq" ? posixPath.dirname(dockerfile) : ".";
 }
 
+function directDockerBuildNetworkArgs(serviceId: string): string[] {
+  if (serviceId !== "code-queue") return [];
+  const noProxy = [
+    "localhost",
+    "127.0.0.1",
+    "::1",
+    "host.docker.internal",
+    "d601-tcp-egress-gateway",
+    "d601-tcp-egress-gateway.unidesk",
+    "d601-tcp-egress-gateway.unidesk.svc",
+    "d601-tcp-egress-gateway.unidesk.svc.cluster.local",
+    "backend-core",
+    "oa-event-flow",
+    "database",
+  ].join(",");
+  return [
+    "--network",
+    "host",
+    "--build-arg",
+    `HTTP_PROXY=${providerGatewayWsEgressProxyUrl}`,
+    "--build-arg",
+    `HTTPS_PROXY=${providerGatewayWsEgressProxyUrl}`,
+    "--build-arg",
+    `http_proxy=${providerGatewayWsEgressProxyUrl}`,
+    "--build-arg",
+    `https_proxy=${providerGatewayWsEgressProxyUrl}`,
+    "--build-arg",
+    `NO_PROXY=${noProxy}`,
+    "--build-arg",
+    `no_proxy=${noProxy}`,
+  ];
+}
+
 function directDockerSourceGitMode(repoUrl: string): "local-unidesk-worktree" | "git-archive" {
   return repoUrl === "https://github.com/pikasTech/unidesk" ? "local-unidesk-worktree" : "git-archive";
 }
@@ -1575,6 +1608,7 @@ async function publishUserServiceArtifactDirectDocker(options: CiPublishUserServ
   const planned = artifactSummaryDefaults(context);
   const localImage = `${options.imageRepository}:${options.commit}`;
   const buildContext = buildContextForService(options.serviceId, options.dockerfile);
+  const networkArgs = directDockerBuildNetworkArgs(options.serviceId);
   const baseArgs = options.serviceId === "code-queue" && runCommand(["docker", "image", "inspect", "unidesk-code-queue:d601"], repoRoot, { timeoutMs: 30_000 }).exitCode === 0
     ? ["--build-arg", "CODE_QUEUE_BASE_IMAGE=unidesk-code-queue:d601"]
     : [];
@@ -1614,6 +1648,7 @@ async function publishUserServiceArtifactDirectDocker(options: CiPublishUserServ
       `unidesk.ai/source-commit=${options.commit}`,
       "--label",
       `unidesk.ai/dockerfile=${options.dockerfile}`,
+      ...networkArgs,
       ...baseArgs,
       "-t",
       localImage,