diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
index 843d5df..c223c43 100644
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/workflow.yml
@@ -159,10 +159,15 @@ jobs:
           iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
         done
 
-        # Block productionresultssa*.blob.core.windows.net (cache blob storage)
-        # We block ALL blob.core.windows.net traffic since we can't easily enumerate all storage accounts
-        # The proxy will handle these requests
-        echo "Note: *.blob.core.windows.net traffic will be blocked and must go through proxy"
+        # Block known blob storage endpoints used by cache
+        # Resolve and block common productionresultssa*.blob.core.windows.net endpoints
+        for i in 0 1 2 3 4 5 6 7 8 9 10 11 12; do
+          BLOB_HOST="productionresultssa${i}.blob.core.windows.net"
+          for ip in $(getent ahosts "$BLOB_HOST" 2>/dev/null | awk '{print $1}' | sort -u); do
+            echo "Blocking direct access to $BLOB_HOST: $ip"
+            iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
+          done
+        done
 
         # Block all other outbound HTTP/HTTPS traffic
         iptables -A OUTPUT -p tcp --dport 80 -j REJECT
@@ -178,7 +183,7 @@ jobs:
 
         # Test 1: Direct connection to github.com should work (it's in allowed IPs)
         echo "Test 1: Direct connection to github.com (should SUCCEED - GitHub IP allowed)"
-        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://api.github.com/zen 2>/dev/null; then
+        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://api.github.com/zen 2>/dev/null; then
           echo "✓ Direct GitHub API access works (expected)"
         else
           echo "✗ Direct GitHub API access failed (unexpected but not critical)"
@@ -187,7 +192,7 @@ jobs:
         # Test 2: Direct connection to blob storage should FAIL
         echo ""
         echo "Test 2: Direct connection to blob storage (should FAIL - must use proxy)"
-        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
+        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
           echo "✗ ERROR: Direct blob storage connection succeeded but should have been blocked!"
           exit 1
         else
@@ -197,8 +202,10 @@ jobs:
         # Test 3: Connection through proxy should work
         echo ""
         echo "Test 3: Connection through proxy to blob storage (should SUCCEED)"
-        if curl --connect-timeout 5 --max-time 10 -sS https://productionresultssa0.blob.core.windows.net 2>&1 | head -5; then
-          echo "✓ Proxy connection works (expected - even if 4xx/5xx response, connection succeeded)"
+        # Using proxy (from env vars), we should be able to connect even if we get an HTTP error
+        HTTP_CODE=$(curl --connect-timeout 5 --max-time 10 -sS -o /dev/null -w "%{http_code}" https://productionresultssa0.blob.core.windows.net 2>/dev/null || echo "000")
+        if [ "$HTTP_CODE" != "000" ]; then
+          echo "✓ Proxy connection works (HTTP $HTTP_CODE - connection succeeded through proxy)"
         else
           echo "Note: Proxy connection may have failed, but that's OK if it's not a network block"
         fi
@@ -395,10 +402,15 @@ jobs:
           iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
         done
 
-        # Block productionresultssa*.blob.core.windows.net (cache blob storage)
-        # We block ALL blob.core.windows.net traffic since we can't easily enumerate all storage accounts
-        # The proxy will handle these requests
-        echo "Note: *.blob.core.windows.net traffic will be blocked and must go through proxy"
+        # Block known blob storage endpoints used by cache
+        # Resolve and block common productionresultssa*.blob.core.windows.net endpoints
+        for i in 0 1 2 3 4 5 6 7 8 9 10 11 12; do
+          BLOB_HOST="productionresultssa${i}.blob.core.windows.net"
+          for ip in $(getent ahosts "$BLOB_HOST" 2>/dev/null | awk '{print $1}' | sort -u); do
+            echo "Blocking direct access to $BLOB_HOST: $ip"
+            iptables -I OUTPUT 1 -d "$ip" -p tcp --dport 443 -j REJECT
+          done
+        done
 
         # Block all other outbound HTTP/HTTPS traffic
         iptables -A OUTPUT -p tcp --dport 80 -j REJECT
@@ -414,7 +426,7 @@ jobs:
 
         # Test 1: Direct connection to github.com should work (it's in allowed IPs)
         echo "Test 1: Direct connection to github.com (should SUCCEED - GitHub IP allowed)"
-        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://api.github.com/zen 2>/dev/null; then
+        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://api.github.com/zen 2>/dev/null; then
           echo "✓ Direct GitHub API access works (expected)"
         else
           echo "✗ Direct GitHub API access failed (unexpected but not critical)"
@@ -423,7 +435,7 @@ jobs:
         # Test 2: Direct connection to blob storage should FAIL
         echo ""
         echo "Test 2: Direct connection to blob storage (should FAIL - must use proxy)"
-        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sS https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
+        if curl --connect-timeout 5 --max-time 10 --noproxy '*' -sSf -o /dev/null https://productionresultssa0.blob.core.windows.net 2>/dev/null; then
           echo "✗ ERROR: Direct blob storage connection succeeded but should have been blocked!"
           exit 1
         else
@@ -433,8 +445,10 @@ jobs:
         # Test 3: Connection through proxy should work
         echo ""
         echo "Test 3: Connection through proxy to blob storage (should SUCCEED)"
-        if curl --connect-timeout 5 --max-time 10 -sS https://productionresultssa0.blob.core.windows.net 2>&1 | head -5; then
-          echo "✓ Proxy connection works (expected - even if 4xx/5xx response, connection succeeded)"
+        # Using proxy (from env vars), we should be able to connect even if we get an HTTP error
+        HTTP_CODE=$(curl --connect-timeout 5 --max-time 10 -sS -o /dev/null -w "%{http_code}" https://productionresultssa0.blob.core.windows.net 2>/dev/null || echo "000")
+        if [ "$HTTP_CODE" != "000" ]; then
+          echo "✓ Proxy connection works (HTTP $HTTP_CODE - connection succeeded through proxy)"
         else
           echo "Note: Proxy connection may have failed, but that's OK if it's not a network block"
         fi