diff --git a/docker/compose.ci.yml b/docker/compose.ci.yml
index 5a5069e..1439863 100644
--- a/docker/compose.ci.yml
+++ b/docker/compose.ci.yml
@@ -52,6 +52,10 @@ services:
     volumes: !reset []
     # frontend/playwright.config.ts defaults baseURL to the test stack's
     # hostname, which resolves to nothing in here. The backend serves the SPA
-    # and its API on one origin.
+    # and its API on one origin. Reached as localhost from inside the
+    # backend's network namespace, because http://backend:8000 is not a secure
+    # context and the clipboard spec needs navigator.clipboard, which only a
+    # secure context has. Service names still resolve in there.
+    network_mode: service:backend
     environment:
-      - PLAYWRIGHT_BASE_URL=http://backend:8000
+      - PLAYWRIGHT_BASE_URL=http://localhost:8000
diff --git a/docker/compose.dev.yml b/docker/compose.dev.yml
index 2b40d8c..41d17a9 100644
--- a/docker/compose.dev.yml
+++ b/docker/compose.dev.yml
@@ -75,8 +75,11 @@ services:
     image: eclipse-mosquitto:2
     restart: "no"
     # The config the image ships for exactly this: listener on 1883, anonymous
-    # clients allowed. Its default config accepts neither.
-    command: mosquitto -c /mosquitto-no-auth.conf
+    # clients allowed. Its default config accepts neither. Read from
+    # /etc/mosquitto, because Ubuntu's AppArmor profile for /usr/sbin/mosquitto
+    # allows nothing else, and it confines the broker wherever Docker leaves
+    # containers unconfined (the CI runner's Docker-in-Docker).
+    command: sh -c "mkdir -p /etc/mosquitto && cp /mosquitto-no-auth.conf /etc/mosquitto/mosquitto.conf && exec mosquitto -c /etc/mosquitto/mosquitto.conf"
 
   influxdb:
     logging: *logging