diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index fbd064e..c5f75e5 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -68,3 +68,25 @@ jobs:
           sshpass -e ssh -o StrictHostKeyChecking=no \
             -p "$WIN_PORT" "$WIN_USER@$WIN_HOST" \
             "echo TODO: run actual test command here"
+
+  # Always-runs cleanup: rolls the VM back to the gold snapshot on the host.
+  # In a separate job so it fires even when windows-test crashes mid-step.
+  revert-vm:
+    runs-on: docker
+    needs: [windows-test]
+    if: always()
+    steps:
+      - name: Install client tools
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq curl iproute2
+
+      - name: Trigger revert on host
+        env:
+          REVERT_TOKEN: ${{ secrets.REVERT_TOKEN }}
+        run: |
+          GW=$(ip route | awk '/default/ {print $3; exit}')
+          echo "calling revert endpoint at $GW:8765"
+          curl -fsSL --max-time 90 -X POST \
+            -H "Authorization: Bearer $REVERT_TOKEN" \
+            "http://$GW:8765/revert"