diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 182328d..4e98690 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -31,9 +31,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     env:
-      SITE_PORT: "8080"
-      KANBAN_PORT: "8081"
-      API_PORT: "8000"
+      # The runner shares the host's Docker daemon, so every published port is
+      # taken on the machine itself and 8000/8080/9000 collide with whatever else
+      # runs there. Use a high block that nothing is likely to hold.
+      SITE_PORT: "18080"
+      KANBAN_PORT: "18081"
+      API_PORT: "18000"
+      STORAGE_PORT: "19000"
+      STORAGE_CONSOLE_PORT: "19001"
       COMPOSE: docker compose -f compose.local.yaml
     steps:
       - name: Checkout
diff --git a/compose.local.yaml b/compose.local.yaml
index 04719b1..5debf51 100644
--- a/compose.local.yaml
+++ b/compose.local.yaml
@@ -14,7 +14,7 @@ x-app: &app
     APP_ENV: local
     DATABASE_URL: postgresql://${APP_DB_USER:-dtf_app}:${APP_DB_PASSWORD:-local-app-database-only}@db:5432/${POSTGRES_DB:-dtf_local}
     S3_ENDPOINT: http://storage:9000
-    S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:9000}
+    S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:${STORAGE_PORT:-9000}}
     S3_BUCKET: ${S3_BUCKET:-dtf-local-artwork}
     AWS_ACCESS_KEY_ID: ${S3_APP_USER:-dtf_app}
     AWS_SECRET_ACCESS_KEY: ${S3_APP_PASSWORD:-local-app-storage-only}
@@ -74,7 +74,9 @@ services:
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:-dtf_local}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-local-storage-only}
-    ports: ["127.0.0.1:9000:9000", "127.0.0.1:9001:9001"]
+    ports:
+      - "127.0.0.1:${STORAGE_PORT:-9000}:9000"
+      - "127.0.0.1:${STORAGE_CONSOLE_PORT:-9001}:9001"
     volumes: [storage-data:/data]
     networks: [local, edge]
     healthcheck:
@@ -165,9 +167,13 @@ services:
       context: .
       dockerfile: local/Dockerfile.web
     environment:
-      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:9000}
+      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:${STORAGE_PORT:-9000}}
     ports:
+      # Published ports are host-wide even bound to loopback, so on a shared
+      # machine any of them can collide with something unrelated. CI overrides
+      # every one; see .gitea/workflows/deploy.yml.
       - "127.0.0.1:${SITE_PORT:-8080}:80"
+      # Convenience only: the API through its own gateway. No test uses it.
       - "127.0.0.1:${API_PORT:-8000}:81"
     networks: [local, edge]
     depends_on:
@@ -184,7 +190,7 @@ services:
       dockerfile: local/Dockerfile.web
     environment:
       WEB_INDEX: kanban.html
-      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:9000}
+      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:${STORAGE_PORT:-9000}}
     ports: ["127.0.0.1:${KANBAN_PORT:-8081}:80"]
     networks: [local, edge]
     depends_on: