diff --git a/.github/workflows/rate-limit.yml b/.github/workflows/rate-limit.yml
index 53f0448e63d..2363f98d64b 100644
--- a/.github/workflows/rate-limit.yml
+++ b/.github/workflows/rate-limit.yml
@@ -58,11 +58,36 @@ jobs:
         name: run docker images
         run: |
           docker run --name etherpad-docker -p 9000:9001 --rm --network ep_net --ip 172.23.42.2 -e 'TRUST_PROXY=true' epl-debian-slim &
-          docker run -p 8081:80 --rm --network ep_net --ip 172.23.42.1 -d nginx-latest
+          docker run --name nginx-docker -p 8081:80 --rm --network ep_net --ip 172.23.42.1 -d nginx-latest
           docker run --rm --network ep_net --ip 172.23.42.3 --name anotherip -dt anotherip
       -
         name: install dependencies and create symlink for ep_etherpad-lite
         run: pnpm install --frozen-lockfile
+      -
+        # The etherpad container is started in the background above; without
+        # this wait the test step can hit nginx before etherpad is listening
+        # and nginx returns 502, failing the run on a cold cache. Poll the
+        # nginx-proxied endpoint (which is also what the test hits) until it
+        # stops returning 5xx.
+        name: Wait for etherpad behind nginx to be ready
+        run: |
+          # ~60s budget: 30 iterations × (1s curl timeout + 1s sleep).
+          # Cold-start of the etherpad container is well under that.
+          for i in $(seq 1 30); do
+            if curl -fsS -o /dev/null --max-time 1 http://127.0.0.1:8081/; then
+              echo "etherpad is ready behind nginx"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "ERROR: etherpad behind nginx did not become ready in time"
+          echo "--- docker ps ---"
+          docker ps -a || true
+          echo "--- nginx-docker logs ---"
+          docker logs nginx-docker || true
+          echo "--- etherpad-docker logs ---"
+          docker logs etherpad-docker || true
+          exit 1
       -
         name: run rate limit test
         run: |