diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index dd12079..1b87707 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -28,16 +28,24 @@ jobs:
         run: docker build -t thermograph-backend:ci .
 
       - name: Boot + health check
+        # No -p host-port publish and a unique-per-run container name (this
+        # runner's snap-Docker install has a known AppArmor bug denying
+        # docker stop/kill -- a leftover container from a prior failed run
+        # would otherwise permanently squat a fixed host port and block
+        # every subsequent run too). Curl the container's own bridge-network
+        # IP directly instead.
         run: |
-          docker run -d --name backend-ci \
+          name="backend-ci-$$"
+          docker run -d --name "$name" \
             -e THERMOGRAPH_FRONTEND_BASE_INTERNAL=http://127.0.0.1:1 \
-            -p 8137:8137 thermograph-backend:ci
+            thermograph-backend:ci
+          ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$name")
           ok=0
           for i in $(seq 1 30); do
-            if curl -fsS -o /dev/null http://127.0.0.1:8137/healthz; then ok=1; break; fi
+            if curl -fsS -o /dev/null "http://${ip}:8137/healthz"; then ok=1; break; fi
             sleep 1
           done
-          docker logs backend-ci
-          docker rm -f backend-ci >/dev/null 2>&1 || true
+          docker logs "$name"
+          docker rm -f "$name" >/dev/null 2>&1 || true
           if [ "$ok" != 1 ]; then echo "backend never became healthy"; exit 1; fi
           echo "OK: backend booted standalone"