diff --git a/.github/workflows/pr-test.yml b/.github/workflows/pr-test.yml
index 3f1bcfa4..ed92566b 100644
--- a/.github/workflows/pr-test.yml
+++ b/.github/workflows/pr-test.yml
@@ -1757,6 +1757,7 @@ jobs:
           TAI_TEST_K8S_HOST: "127.0.0.1"
           TAI_TEST_K8S_PORT: "6443"
           TAI_TEST_KUBECONFIG: "${{ runner.temp }}/kubeconfig-tai.yml"
+          TAI_TEST_HOST_IP: "172.17.0.1"
         run: make unit-test-tai
 
       - name: Codecov Report
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 3e04605e..07d7111c 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -1311,6 +1311,7 @@ jobs:
           TAI_TEST_K8S_HOST: "127.0.0.1"
           TAI_TEST_K8S_PORT: "6443"
           TAI_TEST_KUBECONFIG: "${{ runner.temp }}/kubeconfig-tai.yml"
+          TAI_TEST_HOST_IP: "172.17.0.1"
         run: make unit-test-tai
 
       - name: Codecov Report
diff --git a/cmd/run.go b/cmd/run.go
index f6dcca3b..819d2f75 100644
--- a/cmd/run.go
+++ b/cmd/run.go
@@ -85,7 +85,7 @@ func runGRPC(cred *Credential, args []string) {
 		color.Green(L("Run: %s gRPC: %s\n"), name, cred.GRPCAddr)
 	}
 
-	pargs := parseRunArgs(args[1:])
+	pargs := parseRunArgs(args)
 
 	argsJSON, err := jsoniter.Marshal(pargs)
 	if err != nil {
diff --git a/grpc/tests/testutils/testutils.go b/grpc/tests/testutils/testutils.go
index d7abab80..c384af30 100644
--- a/grpc/tests/testutils/testutils.go
+++ b/grpc/tests/testutils/testutils.go
@@ -2,6 +2,8 @@ package testutils
 
 import (
 	"context"
+	"net"
+	"os"
 	"strings"
 	"testing"
 
@@ -43,7 +45,7 @@ func Prepare(t *testing.T) *grpc.ClientConn {
 
 	cfg := config.Conf
 	cfg.GRPC.Port = 0
-	cfg.GRPC.Host = "127.0.0.1"
+	cfg.GRPC.Host = "0.0.0.0"
 	cfg.GRPC.Enabled = ""
 
 	test.Prepare(t, config.Conf)
@@ -129,6 +131,26 @@ func Addr() string {
 	return addrs[0]
 }
 
+// RelayAddr returns the gRPC address reachable from a Docker container.
+// When TAI_TEST_HOST_IP is set (e.g. to the docker bridge gateway),
+// it replaces the host portion so that the Tai container can reach the
+// Yao gRPC server running on the CI host.
+func RelayAddr() string {
+	addr := Addr()
+	if addr == "" {
+		return ""
+	}
+	hostIP := os.Getenv("TAI_TEST_HOST_IP")
+	if hostIP == "" {
+		return addr
+	}
+	_, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return addr
+	}
+	return hostIP + ":" + port
+}
+
 // ObtainAccessToken mints a token with the given scopes via oauth.MakeAccessToken.
 func ObtainAccessToken(t *testing.T, scopes ...string) string {
 	t.Helper()
diff --git a/tai/grpc/integration_test.go b/tai/grpc/integration_test.go
index 5b534409..4073e163 100644
--- a/tai/grpc/integration_test.go
+++ b/tai/grpc/integration_test.go
@@ -280,11 +280,11 @@ func setupRelayClient(t *testing.T, scopes ...string) *yaogrpc.Client {
 		testutils.Clean()
 	})
 
-	yaoAddr := testutils.Addr()
+	yaoAddr := testutils.RelayAddr()
 	token := testutils.ObtainAccessToken(t, scopes...)
 	refreshToken := testutils.ObtainRefreshToken(t, scopes...)
 
-	// upstream = Yao gRPC address; taiMode = true
+	// upstream = Yao gRPC address reachable from the Tai container
 	tm := yaogrpc.NewTokenManager(token, refreshToken, "relay-sandbox", yaoAddr)
 	client, err := yaogrpc.Dial(taiAddr, tm)
 	require.NoError(t, err)
@@ -305,7 +305,7 @@ func TestRelay_Healthz(t *testing.T) {
 		testutils.Clean()
 	}()
 
-	yaoAddr := testutils.Addr()
+	yaoAddr := testutils.RelayAddr()
 	tm := yaogrpc.NewTokenManager("", "", "", yaoAddr)
 	client, err := yaogrpc.Dial(taiAddr, tm)
 	require.NoError(t, err)
@@ -375,7 +375,7 @@ func TestRelay_Run_NoToken(t *testing.T) {
 		testutils.Clean()
 	}()
 
-	yaoAddr := testutils.Addr()
+	yaoAddr := testutils.RelayAddr()
 	tm := yaogrpc.NewTokenManager("", "", "", yaoAddr)
 	client, err := yaogrpc.Dial(taiAddr, tm)
 	require.NoError(t, err)
@@ -398,7 +398,7 @@ func TestRelay_TokenRefresh(t *testing.T) {
 		testutils.Clean()
 	}()
 
-	yaoAddr := testutils.Addr()
+	yaoAddr := testutils.RelayAddr()
 	scopes := []string{"grpc:run"}
 
 	expiredToken := testutils.ObtainExpiredAccessToken(t, scopes...)