diff --git a/.gitea/workflows/test-backend.yml b/.gitea/workflows/test-backend.yml
index 0aafc34..ac7e3d5 100644
--- a/.gitea/workflows/test-backend.yml
+++ b/.gitea/workflows/test-backend.yml
@@ -13,13 +13,18 @@ env:
   # The compose files live in docker/, so a bare `docker compose` from the repo
   # root finds nothing. With COMPOSE_FILE set, compose reads .env from the
   # working directory — the same file the backend settings load as ../.env.
-  # The CI-only project name keeps the `down -v` steps away from a dev stack.
-  COMPOSE_FILE: docker/compose.yml:docker/compose.dev.yml
-  COMPOSE_PROJECT_NAME: fluksio-app-ci
+  # compose.ci.yml drops the fixed container_names and the fixed 5432 — both
+  # daemon-global, so without it a second run on the same host cannot start.
+  COMPOSE_FILE: docker/compose.yml:docker/compose.dev.yml:docker/compose.ci.yml
 
 jobs:
   test-backend:
     runs-on: ubuntu-latest
+    env:
+      # Per run, so the `down -v` steps reach neither a dev stack nor a run
+      # still going. Unique names cannot be recycled, hence the always-on
+      # teardown below.
+      COMPOSE_PROJECT_NAME: fluksio-app-ci-backend-${{ github.run_id }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -36,14 +41,18 @@ jobs:
             uv.lock
       - name: Write .env
         # Not committed, and both compose and the backend settings need it.
-        # POSTGRES_SERVER=localhost there matches the port db publishes in the
-        # dev overlay, so the suite runs on the runner against the container.
+        # The suite runs on the runner and reaches the container over
+        # POSTGRES_SERVER=localhost from there, on the port resolved below.
         run: cp .env.example .env
       - run: docker compose down -v --remove-orphans
       # Postgres is the only service the suite needs: the mail paths are
       # patched in tests/, and the flow engine falls back to in-memory state
       # while REDIS_HOST is empty.
       - run: docker compose up -d --wait db
+      - name: Resolve the db port
+        # Docker assigns it (docker/compose.ci.yml), so concurrent runs get one
+        # each. An env var outranks the .env file in the backend settings.
+        run: echo "POSTGRES_PORT=$(docker compose port db 5432 | tail -n1 | cut -d: -f2)" >> "$GITHUB_ENV"
       - run: uv sync
       - name: Migrate DB and seed the superuser
         run: uv run bash scripts/prestart.sh
diff --git a/docker/compose.ci.yml b/docker/compose.ci.yml
index 541d3c4..18958ae 100644
--- a/docker/compose.ci.yml
+++ b/docker/compose.ci.yml
@@ -18,7 +18,11 @@ services:
 
   db:
     container_name: !reset null
-    ports: !reset []
+    # The one service a job may need from the host: test-backend.yml runs pytest
+    # on the runner. Host side left to Docker, so concurrent jobs get a port
+    # each — `docker compose port db 5432` says which.
+    ports: !override
+      - "5432"
 
   redis:
     container_name: !reset null