diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 5f2ab38..0442f2d 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -156,6 +156,11 @@ jobs:
               tr -d '\r\n\t '
           )"
 
+          K8S_TLS_SERVER_NAME="$(
+            printf '%s' "${K8S_TLS_SERVER_NAME:-}" |
+              tr -d '\r\n\t '
+          )"
+
           if ! printf '%s' "${K8S_SERVER}" |
             grep -Eq '^https://[^[:space:]]+:[0-9]+$'; then
             echo "ERROR: K8S_SERVER no tiene un formato válido."
@@ -169,6 +174,22 @@ jobs:
             exit 1
           fi
 
+          K8S_SERVER_HOST="$(
+            printf '%s' "${K8S_SERVER}" |
+              sed -E 's#^https://\[?([^]]+)\]?:[0-9]+$#\1#'
+          )"
+
+          if [ -z "${K8S_TLS_SERVER_NAME}" ]; then
+            K8S_TLS_SERVER_NAME="${K8S_SERVER_HOST}"
+          fi
+
+          if [ "${K8S_TLS_SERVER_NAME}" != "${K8S_SERVER_HOST}" ]; then
+            echo "ERROR: K8S_TLS_SERVER_NAME no coincide con el host de K8S_SERVER."
+            echo "Host de K8S_SERVER: ${K8S_SERVER_HOST}"
+            echo "Valor esperado del secret K8S_TLS_SERVER_NAME: ${K8S_SERVER_HOST}"
+            exit 1
+          fi
+
           if ! printf '%s' "${K8S_CA_B64}" |
             grep -Eq '^[A-Za-z0-9+/]*={0,2}$'; then
             echo "ERROR: K8S_CA_B64 contiene caracteres que no pertenecen a Base64."