diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index ae15631..2ab8a71 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -67,10 +67,11 @@ jobs:
       - name: Verify image starts
         run: |
           set -euo pipefail
+          docker network create ci-test-net 2>/dev/null || true
           docker stop ci-test || true
           docker rm ci-test || true
           docker run -d --name ci-test \
-            -p 0:80 \
+            --network ci-test-net \
             -e APP_ENV=ci \
             -e APP_VERSION=ci-${{ gitea.sha }} \
             -e BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
@@ -78,13 +79,14 @@ jobs:
             -e GIT_BRANCH=${{ gitea.ref_name }} \
             -e DEPLOY_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
             ci-image:latest
-          CI_PORT=$(docker port ci-test 80 | cut -d: -f2)
+          CI_IP=$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' ci-test)
           for i in $(seq 1 12); do
-            if curl -sf http://localhost:$CI_PORT/health > /dev/null 2>&1; then
+            if curl -sf http://$CI_IP/health > /dev/null 2>&1; then
               echo "::notice::Health check passed"
               docker logs ci-test 2>&1 || true
               docker stop ci-test
               docker rm ci-test
+              docker network rm ci-test-net
               exit 0
             fi
             sleep 5
@@ -93,6 +95,7 @@ jobs:
           docker logs ci-test 2>&1 || true
           docker stop ci-test
           docker rm ci-test
+          docker network rm ci-test-net
           exit 1
           
       - name: Move cache