diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml
index 0e7f3ca..837a827 100644
--- a/.github/workflows/kube-bench-scan.yml
+++ b/.github/workflows/kube-bench-scan.yml
@@ -47,8 +47,17 @@ jobs:
           api_host=127.0.0.1
           if getent hosts host.docker.internal >/dev/null 2>&1; then
             api_host=host.docker.internal
-          elif command -v ip >/dev/null 2>&1; then
-            api_host="$(ip route | awk '/default/ {print $3; exit}')"
+          elif command -v docker >/dev/null 2>&1; then
+            docker_gateway="$(docker network inspect bridge --format '{{(index .IPAM.Config 0).Gateway}}' 2>/dev/null || true)"
+            if [[ -n "$docker_gateway" ]]; then
+              api_host="$docker_gateway"
+            fi
+          fi
+          if [[ "$api_host" == 127.0.0.1 && -r /proc/net/route ]]; then
+            gateway_hex="$(awk '$2 == "00000000" {print $3; exit}' /proc/net/route)"
+            if [[ "$gateway_hex" =~ ^[0-9A-Fa-f]{8}$ ]]; then
+              api_host="$((16#${gateway_hex:6:2})).$((16#${gateway_hex:4:2})).$((16#${gateway_hex:2:2})).$((16#${gateway_hex:0:2}))"
+            fi
           fi
           sed -i -E "s#https://0\.0\.0\.0:#https://${api_host}:#" "$HOME/.kube/config"
           kubectl wait --for=condition=Ready nodes --all --timeout=180s