diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 1b87707..71e03d0 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -28,21 +28,27 @@ jobs:
         run: docker build -t thermograph-backend:ci .
 
       - name: Boot + health check
-        # No -p host-port publish and a unique-per-run container name (this
+        # Curling the sibling container's own bridge IP does NOT work on
+        # this runner (docker-outside-of-docker: the job container's network
+        # namespace can't reach another container's bridge IP directly --
+        # every attempt hangs for the full TCP SYN timeout, ~130s, instead of
+        # failing fast) -- confirmed by a stuck run. 127.0.0.1 DOES work
+        # (proven by the monorepo's own build.yml, which has used a
+        # published host port successfully all along), so publish one, but
+        # to a per-run PID-derived port rather than a fixed one -- this
         # runner's snap-Docker install has a known AppArmor bug denying
-        # docker stop/kill -- a leftover container from a prior failed run
-        # would otherwise permanently squat a fixed host port and block
-        # every subsequent run too). Curl the container's own bridge-network
-        # IP directly instead.
+        # docker stop/kill, so a leftover container from any prior failed
+        # run permanently squats whatever host port it was given, and a
+        # fixed port would block every subsequent run too.
         run: |
           name="backend-ci-$$"
+          port=$((18000 + ($$ % 1000)))
           docker run -d --name "$name" \
             -e THERMOGRAPH_FRONTEND_BASE_INTERNAL=http://127.0.0.1:1 \
-            thermograph-backend:ci
-          ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$name")
+            -p "127.0.0.1:${port}:8137" thermograph-backend:ci
           ok=0
           for i in $(seq 1 30); do
-            if curl -fsS -o /dev/null "http://${ip}:8137/healthz"; then ok=1; break; fi
+            if curl -fsS -o /dev/null "http://127.0.0.1:${port}/healthz"; then ok=1; break; fi
             sleep 1
           done
           docker logs "$name"