diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4e98690..c187491 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -32,13 +32,19 @@ jobs:
     timeout-minutes: 45
     env:
       # The runner shares the host's Docker daemon, so every published port is
-      # taken on the machine itself and 8000/8080/9000 collide with whatever else
-      # runs there. Use a high block that nothing is likely to hold.
-      SITE_PORT: "18080"
-      KANBAN_PORT: "18081"
-      API_PORT: "18000"
-      STORAGE_PORT: "19000"
-      STORAGE_CONSOLE_PORT: "19001"
+      # taken on the machine itself. Known occupants of that host:
+      #   8000, 9443  Portainer (the Edge tunnel and its UI)
+      #   18080/18081 the production dtf-cloud stack (docker-compose.yml defaults)
+      #   8080/8081   deploy/stack.yaml defaults
+      #   9000/9001   MinIO defaults elsewhere
+      # This block avoids all of them. Ephemeral ports are not an option: the
+      # published port is baked into PUBLIC_ORIGIN, ALLOWED_ORIGINS and the CSP
+      # when the containers start, so it has to be known beforehand.
+      SITE_PORT: "28080"
+      KANBAN_PORT: "28081"
+      API_PORT: "28000"
+      STORAGE_PORT: "29000"
+      STORAGE_CONSOLE_PORT: "29001"
       COMPOSE: docker compose -f compose.local.yaml
     steps:
       - name: Checkout