diff --git a/.github/actions/_lib/setup-docker-config/action.yml b/.github/actions/_lib/setup-docker-config/action.yml
index 09effa56eaa3..4b2c3135c5d7 100644
--- a/.github/actions/_lib/setup-docker-config/action.yml
+++ b/.github/actions/_lib/setup-docker-config/action.yml
@@ -16,6 +16,28 @@ runs:
   steps:
     - shell: bash
       run: |
+        # TEMPORARY DIAGNOSTIC (remove before merge): prints only registry names
+        # and booleans, never credential values, to establish whether the runner's
+        # nvcr.io credential is plain-auths (survives the rewrite below) or
+        # helper-backed (destroyed by it). See the fork-PR cuRobo build failures.
+        dump_docker_cfg() {
+          echo "🔍 docker config: $1"
+          python3 -c '
+        import json, os, sys
+        path = sys.argv[1]
+        if not os.path.exists(path):
+            print("   <no config file>")
+            raise SystemExit
+        cfg = json.load(open(path))
+        auths = cfg.get("auths", {})
+        print("   registries      :", sorted(auths))
+        print("   has_credential  :", {k: bool(v) for k, v in sorted(auths.items())})
+        print("   credsStore_set  :", bool(cfg.get("credsStore")))
+        print("   credHelpers_for :", sorted(cfg.get("credHelpers", {})))
+        ' "$1"
+        }
+        dump_docker_cfg "${HOME}/.docker/config.json"
+
         # The runner's credential helper backend is broken ("not implemented")
         # and causes docker login calls to fail unless we point DOCKER_CONFIG at
         # a temp config with credsStore disabled. The value is written to
@@ -23,6 +45,7 @@ runs:
         # invocation sees it already set and short-circuits.
         if [ -n "${DOCKER_CONFIG:-}" ] && [ -f "${DOCKER_CONFIG}/config.json" ]; then
           echo "🟢 Docker config already set up at ${DOCKER_CONFIG}, skipping"
+          dump_docker_cfg "${DOCKER_CONFIG}/config.json"
           exit 0
         fi
 
@@ -34,6 +57,7 @@ runs:
         fi
         export DOCKER_CONFIG="${DOCKER_CONFIG_DIR}"
         echo "DOCKER_CONFIG=${DOCKER_CONFIG_DIR}" >> "$GITHUB_ENV"
+        dump_docker_cfg "${DOCKER_CONFIG_DIR}/config.json"
 
         if [ -n "${NGC_API_KEY:-}" ]; then
           echo "🔵 Logging into nvcr.io..."
diff --git a/docker/Dockerfile.base b/docker/Dockerfile.base
index 41b8e625467a..e8d0a9ea9ff9 100644
--- a/docker/Dockerfile.base
+++ b/docker/Dockerfile.base
@@ -3,6 +3,7 @@
 #
 # SPDX-License-Identifier: BSD-3-Clause
 
+# CI diagnostic: bust the deps-cache so the image is really built (remove with the diagnostic).
 # Isaac Sim base container: https://catalog.ngc.nvidia.com/orgs/nvidia/containers/isaac-sim
 # Please check the NGC container page for license information.
 
diff --git a/docker/Dockerfile.curobo b/docker/Dockerfile.curobo
index c7effe1d7b50..a4e7edf6bfca 100644
--- a/docker/Dockerfile.curobo
+++ b/docker/Dockerfile.curobo
@@ -3,6 +3,7 @@
 #
 # SPDX-License-Identifier: BSD-3-Clause
 
+# CI diagnostic: bust the deps-cache so the image is really built (remove with the diagnostic).
 # Isaac Sim base container: https://catalog.ngc.nvidia.com/orgs/nvidia/containers/isaac-sim
 # Please check the NGC container page for license information.
 
diff --git a/source/isaaclab/changelog.d/jichuanh-ci-docker-cred-diagnostic.skip b/source/isaaclab/changelog.d/jichuanh-ci-docker-cred-diagnostic.skip
new file mode 100644
index 000000000000..e69de29bb2d1