diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b7c6e20..9d26081 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -155,6 +155,11 @@ jobs:
           chmod 0444 "$secret"
           export RENDEZVOUS_UID=1654
           export RENDEZVOUS_GID=1654
+          port_suffix="$(( ${GITHUB_RUN_ID:-$$} % 10000 ))"
+          export RENDEZVOUS_HTTP_HOST_PORT="$(( 20000 + port_suffix ))"
+          export RENDEZVOUS_UDP_HOST_PORT="$(( 40000 + port_suffix ))"
+          export RENDEZVOUS_SMOKE_HTTP_URL="http://127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT}/"
+          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="127.0.0.1:${RENDEZVOUS_UDP_HOST_PORT}"
           export SOURCE_REVISION_ID="$GITHUB_SHA"
           docker compose -f "$compose_file" build \
             --build-arg SOURCE_REVISION_ID="$SOURCE_REVISION_ID"
@@ -166,7 +171,7 @@ jobs:
           test "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination \"/app/appsettings.Production.json\"}}{{.RW}}{{end}}{{end}}' "$container_id")" = "false"
           test "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination \"/run/secrets/rendezvous-signing-key\"}}{{.RW}}{{end}}{{end}}' "$container_id")" = "false"
           for attempt in {1..100}; do
-            if curl --fail --silent http://127.0.0.1:8080/health/ready >/dev/null 2>&1; then
+            if curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1; then
               break
             fi
             if (( attempt == 100 )); then
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 43f9836..d1ae279 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -123,10 +123,15 @@ jobs:
           chmod 0444 "$secret"
           export RENDEZVOUS_UID=1654
           export RENDEZVOUS_GID=1654
+          port_suffix="$(( ${GITHUB_RUN_ID:-$$} % 10000 ))"
+          export RENDEZVOUS_HTTP_HOST_PORT="$(( 20000 + port_suffix ))"
+          export RENDEZVOUS_UDP_HOST_PORT="$(( 40000 + port_suffix ))"
+          export RENDEZVOUS_SMOKE_HTTP_URL="http://127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT}/"
+          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="127.0.0.1:${RENDEZVOUS_UDP_HOST_PORT}"
           export RENDEZVOUS_IMAGE="git.finalfactory.de/heikyu/rendezvous:${RENDEZVOUS_VERSION}"
           docker compose -f deploy/compose/compose.yaml up --detach --no-build
           for attempt in {1..100}; do
-            curl --fail --silent http://127.0.0.1:8080/health/ready >/dev/null 2>&1 && break
+            curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1 && break
             if (( attempt == 100 )); then
               docker compose -f deploy/compose/compose.yaml logs rendezvous
               exit 1
diff --git a/deploy/compose/compose.yaml b/deploy/compose/compose.yaml
index 10947e0..59ea1cf 100644
--- a/deploy/compose/compose.yaml
+++ b/deploy/compose/compose.yaml
@@ -33,5 +33,5 @@ services:
       - ./appsettings.Production.json:/app/appsettings.Production.json:ro
       - ./secrets/signing-key:/run/secrets/rendezvous-signing-key:ro
     ports:
-      - "127.0.0.1:8080:8080/tcp"
-      - "9050:9050/udp"
+      - "127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT:-8080}:8080/tcp"
+      - "${RENDEZVOUS_UDP_HOST_PORT:-9050}:9050/udp"
diff --git a/docs/deployment/linux.md b/docs/deployment/linux.md
index 4f721ed..f530c7e 100644
--- a/docs/deployment/linux.md
+++ b/docs/deployment/linux.md
@@ -42,6 +42,12 @@ test "$RENDEZVOUS_UID" -ne 0
 docker compose -f deploy/compose/compose.yaml up --build --detach
 ```
 
+The example defaults to host TCP 8080 and UDP 9050. On a shared host, set
+`RENDEZVOUS_HTTP_HOST_PORT` and `RENDEZVOUS_UDP_HOST_PORT` before starting
+Compose, then point `RENDEZVOUS_SMOKE_HTTP_URL` and
+`RENDEZVOUS_SMOKE_UDP_ENDPOINT` at those published ports. The container ports
+and production-advertised service ports remain 8080/9050.
+
 `deploy/compose/appsettings.Production.json` is a local/private-bridge smoke
 profile, not an Internet template: TCP is published only on host loopback, the
 explicit `rendezvous` host name serves isolated clients on the Compose network,
diff --git a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
index e8e60e5..b5ef479 100644
--- a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
+++ b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
@@ -164,6 +164,25 @@ public sealed class ReleaseCompatibilityTests
         Assert.Contains("Microsoft.NETCore.App/8.0.28", releaseBuilder, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public void AutomationUsesPerRunContainerPorts()
+    {
+        string root = FindRepositoryRoot();
+        string compose = File.ReadAllText(Path.Combine(root, "deploy/compose/compose.yaml"));
+        Assert.Contains("${RENDEZVOUS_HTTP_HOST_PORT:-8080}:8080/tcp", compose, StringComparison.Ordinal);
+        Assert.Contains("${RENDEZVOUS_UDP_HOST_PORT:-9050}:9050/udp", compose, StringComparison.Ordinal);
+
+        foreach (string workflowName in new[] { "ci.yml", "release.yml" })
+        {
+            string workflow = File.ReadAllText(Path.Combine(root, ".gitea/workflows", workflowName));
+            Assert.Contains("GITHUB_RUN_ID", workflow, StringComparison.Ordinal);
+            Assert.Contains("RENDEZVOUS_HTTP_HOST_PORT", workflow, StringComparison.Ordinal);
+            Assert.Contains("RENDEZVOUS_UDP_HOST_PORT", workflow, StringComparison.Ordinal);
+            Assert.Contains("RENDEZVOUS_SMOKE_HTTP_URL", workflow, StringComparison.Ordinal);
+            Assert.Contains("RENDEZVOUS_SMOKE_UDP_ENDPOINT", workflow, StringComparison.Ordinal);
+        }
+    }
+
     [Fact]
     public void ServerSourceManifestIsCompleteSortedAndDeterministic()
     {