diff --git a/.gitea/scripts/start-radicale.sh b/.gitea/scripts/start-radicale.sh
index 412571a..e3d4774 100755
--- a/.gitea/scripts/start-radicale.sh
+++ b/.gitea/scripts/start-radicale.sh
@@ -24,8 +24,18 @@ htpasswd_encryption = plain
 filesystem_folder = $work/data
 CONF
 "$python" -m radicale --config "$work/config" > "$work/radicale.log" 2>&1 &
+# The readiness probe uses the same Python, not curl: ci.yml's job image has no curl.
+ready='
+import base64, sys, urllib.request
+req = urllib.request.Request("http://127.0.0.1:5232/ci/", method="PROPFIND",
+    headers={"Depth": "0", "Authorization": "Basic " + base64.b64encode(b"ci:ci-live-secret").decode()})
+try:
+    urllib.request.urlopen(req, timeout=2)
+except Exception:
+    sys.exit(1)
+'
 i=0
-until curl -fsS -o /dev/null -u ci:ci-live-secret -X PROPFIND -H 'Depth: 0' http://127.0.0.1:5232/ci/; do
+until "$python" -c "$ready"; do
   i=$((i + 1))
   if [ "$i" -gt 30 ]; then
     echo "radicale did not come up:" >&2