diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 405bf36..f8d9756 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -144,7 +144,11 @@ jobs:
           set -euo pipefail
           compose_file="deploy/compose/compose.yaml"
           secret="deploy/compose/secrets/signing-key"
+          compose_network=""
           cleanup() {
+            if [[ -n "$compose_network" ]]; then
+              docker network disconnect "$compose_network" "$HOSTNAME" >/dev/null 2>&1 || true
+            fi
             RENDEZVOUS_UID=1654 RENDEZVOUS_GID=1654 \
               docker compose -f "$compose_file" down --volumes >/dev/null 2>&1 || true
             rm -f "$secret"
@@ -158,8 +162,6 @@ jobs:
           port_suffix="$(( ${GITHUB_RUN_ID:-$$} % 10000 ))"
           export RENDEZVOUS_HTTP_HOST_PORT="$(( 20000 + port_suffix ))"
           export RENDEZVOUS_UDP_HOST_PORT="$(( 40000 + port_suffix ))"
-          runner_network="$(docker inspect "$HOSTNAME" | jq -er \
-            '.[0].NetworkSettings.Networks | keys[0]')"
           runner_workspace_source="$(docker inspect "$HOSTNAME" | jq -er \
             --arg destination "$GITHUB_WORKSPACE" \
             '.[0].Mounts[] | select(.Destination == $destination) | .Source')"
@@ -171,9 +173,11 @@ jobs:
           docker compose -f "$compose_file" up --no-build --detach
           container_id="$(docker compose -f "$compose_file" ps -q rendezvous)"
           test -n "$container_id"
-          docker network connect "$runner_network" "$container_id"
+          compose_network="$(docker inspect "$container_id" | jq -er \
+            '.[0].NetworkSettings.Networks | keys[0]')"
+          docker network connect "$compose_network" "$HOSTNAME"
           service_ip="$(docker inspect "$container_id" | jq -er \
-            --arg network "$runner_network" \
+            --arg network "$compose_network" \
             '.[0].NetworkSettings.Networks[$network].IPAddress')"
           export RENDEZVOUS_SMOKE_HTTP_URL="http://${service_ip}:8080/"
           export RENDEZVOUS_SMOKE_UDP_ENDPOINT="${service_ip}:9050"
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 55f1a28..b6b43ba 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -112,7 +112,11 @@ jobs:
         run: |
           set -euo pipefail
           secret="deploy/compose/secrets/signing-key"
+          compose_network=""
           cleanup() {
+            if [[ -n "$compose_network" ]]; then
+              docker network disconnect "$compose_network" "$HOSTNAME" >/dev/null 2>&1 || true
+            fi
             RENDEZVOUS_UID=1654 RENDEZVOUS_GID=1654 RENDEZVOUS_IMAGE="git.finalfactory.de/heikyu/rendezvous:${RENDEZVOUS_VERSION}" \
               docker compose -f deploy/compose/compose.yaml down --volumes >/dev/null 2>&1 || true
             rm -f "$secret"
@@ -126,8 +130,6 @@ jobs:
           port_suffix="$(( ${GITHUB_RUN_ID:-$$} % 10000 ))"
           export RENDEZVOUS_HTTP_HOST_PORT="$(( 20000 + port_suffix ))"
           export RENDEZVOUS_UDP_HOST_PORT="$(( 40000 + port_suffix ))"
-          runner_network="$(docker inspect "$HOSTNAME" | jq -er \
-            '.[0].NetworkSettings.Networks | keys[0]')"
           runner_workspace_source="$(docker inspect "$HOSTNAME" | jq -er \
             --arg destination "$GITHUB_WORKSPACE" \
             '.[0].Mounts[] | select(.Destination == $destination) | .Source')"
@@ -137,9 +139,11 @@ jobs:
           docker compose -f deploy/compose/compose.yaml up --detach --no-build
           container_id="$(docker compose -f deploy/compose/compose.yaml ps -q rendezvous)"
           test -n "$container_id"
-          docker network connect "$runner_network" "$container_id"
+          compose_network="$(docker inspect "$container_id" | jq -er \
+            '.[0].NetworkSettings.Networks | keys[0]')"
+          docker network connect "$compose_network" "$HOSTNAME"
           service_ip="$(docker inspect "$container_id" | jq -er \
-            --arg network "$runner_network" \
+            --arg network "$compose_network" \
             '.[0].NetworkSettings.Networks[$network].IPAddress')"
           export RENDEZVOUS_SMOKE_HTTP_URL="http://${service_ip}:8080/"
           export RENDEZVOUS_SMOKE_UDP_ENDPOINT="${service_ip}:9050"
diff --git a/docs/deployment/linux.md b/docs/deployment/linux.md
index 337e217..90e1a68 100644
--- a/docs/deployment/linux.md
+++ b/docs/deployment/linux.md
@@ -50,8 +50,8 @@ and production-advertised service ports remain 8080/9050. Sibling-container CI
 runners may also set `RENDEZVOUS_CONFIG_SOURCE` and
 `RENDEZVOUS_SECRET_SOURCE` to host-visible absolute bind-source paths; local
 operators should normally keep the checked-in relative defaults. CI attaches
-the service to the ephemeral job network for smoke traffic; it does not widen
-the default loopback HTTP publication.
+its ephemeral job container to the isolated Compose network for smoke traffic;
+it does not widen the default loopback HTTP publication.
 
 `deploy/compose/appsettings.Production.json` is a local/private-bridge smoke
 profile, not an Internet template: TCP is published only on host loopback, the
diff --git a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
index 637f855..db5b0e9 100644
--- a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
+++ b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
@@ -178,8 +178,10 @@ public sealed class ReleaseCompatibilityTests
         {
             string workflow = File.ReadAllText(Path.Combine(root, ".gitea/workflows", workflowName));
             Assert.Contains("GITHUB_RUN_ID", workflow, StringComparison.Ordinal);
-            Assert.Contains("runner_network", workflow, StringComparison.Ordinal);
+            Assert.Contains("compose_network", workflow, StringComparison.Ordinal);
             Assert.Contains("docker network connect", workflow, StringComparison.Ordinal);
+            Assert.Contains("docker network disconnect", workflow, StringComparison.Ordinal);
+            Assert.Contains("\"$compose_network\" \"$HOSTNAME\"", workflow, StringComparison.Ordinal);
             Assert.Contains("service_ip", workflow, StringComparison.Ordinal);
             Assert.Contains("RENDEZVOUS_HTTP_HOST_PORT", workflow, StringComparison.Ordinal);
             Assert.Contains("RENDEZVOUS_UDP_HOST_PORT", workflow, StringComparison.Ordinal);