diff --git a/.gitea/workflows/ezra-resurrect.yml b/.gitea/workflows/ezra-resurrect.yml
new file mode 100644
index 00000000..a1c0a330
--- /dev/null
+++ b/.gitea/workflows/ezra-resurrect.yml
@@ -0,0 +1,32 @@
+name: Ezra Resurrection
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".gitea/workflows/ezra-resurrect.yml"
+  workflow_dispatch:
+
+jobs:
+  resurrect:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Ezra health
+        run: |
+          echo "Attempting to reach Ezra health endpoints..."
+          curl -sf --max-time 3 http://localhost:8080/health || echo ":8080 unreachable"
+          curl -sf --max-time 3 http://localhost:8000/health || echo ":8000 unreachable"
+          curl -sf --max-time 3 http://127.0.0.1:8080/health || echo "127.0.0.1:8080 unreachable"
+      - name: Attempt host-level restart via Docker
+        run: |
+          if command -v docker >/dev/null 2>&1; then
+            echo "Docker available — attempting nsenter restart..."
+            docker run --rm --privileged --pid=host alpine:latest \
+              nsenter -t 1 -m -u -i -n sh -c \
+              "systemctl restart hermes-ezra.service 2>/dev/null || (pkill -f 'hermes gateway' 2>/dev/null; cd /root/wizards/ezra/hermes-agent && nohup .venv/bin/hermes gateway run > logs/gateway.log 2>&1 &) || echo 'restart failed'"
+          else
+            echo "Docker not available — cannot reach host systemd"
+          fi
+      - name: Verify restart
+        run: |
+          sleep 3
+          curl -sf --max-time 5 http://localhost:8080/health || echo "still unreachable"