diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f8b363f..bc3a767 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -153,6 +153,26 @@ jobs:
             if [ "$NAME" = "$WANT" ]; then FOUND="$ip"; fi
           done
           [ -n "$FOUND" ] || { echo "FATAL: no OpenSearch behind the alias identifies as $WANT"; exit 1; }
+
+          # The single-node test cluster inherits the runner's disk watermark.
+          # On a busy runner the flood-stage watermark makes every new index
+          # read-only and the suite fails with HTTP 403
+          # index_create_block_exception (measured on run 388536). The container
+          # is throwaway CI state, so disable the disk threshold and PROVE that
+          # index creation works before the blocking tests run.
+          for attempt in 1 2 3 4 5; do
+            curl -fsS --max-time 10 -X PUT "http://$FOUND:9200/_cluster/settings" \
+              -H 'Content-Type: application/json' \
+              -d '{"persistent":{"cluster.routing.allocation.disk.threshold_enabled":false}}' >/dev/null || true
+            if curl -fsS --max-time 10 -X PUT "http://$FOUND:9200/opt-ci-probe-${{ github.run_id }}" >/dev/null; then
+              curl -fsS --max-time 10 -X DELETE "http://$FOUND:9200/opt-ci-probe-${{ github.run_id }}" >/dev/null || true
+              echo "OpenSearch accepts index creation"
+              break
+            fi
+            echo "index creation not ready (attempt $attempt/5) — waiting"
+            [ "$attempt" = "5" ] && { echo "FATAL: OpenSearch still refuses index creation"; exit 1; }
+            sleep 10
+          done
           echo "OPENSEARCH_URL=http://$FOUND:9200" >> "$GITHUB_ENV"
       - name: Select THIS run's ClickHouse by identity
         run: |