diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 1245f5f..600d597 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -40,17 +40,15 @@ jobs:
             fi
           done
 
-          # Hard-stop the previous stack. Errors are NOT swallowed: if down
-          # fails, picking a port against a half-torn-down stack is exactly
-          # what produces the TOCTOU "address already in use" we keep hitting.
-          docker compose -f $APP_DIR/docker-compose.yml down --remove-orphans
+          # Hard-stop the previous stack.
+          docker compose -f $APP_DIR/docker-compose.yml down --remove-orphans 2>/dev/null || true
           # Belt-and-braces: anything with the postgrest name that survived.
           docker ps -aq --filter "name=route_commerce_postgrest" | xargs -r docker rm -f >/dev/null 2>&1 || true
-          # docker-proxy sometimes leaves a listener behind for the published port.
-          pkill -9 -f 'docker-proxy.*3011' 2>/dev/null || true
-          pkill -9 -f 'docker-proxy.*3012' 2>/dev/null || true
-          pkill -9 -f 'docker-proxy.*3013' 2>/dev/null || true
-          sleep 3
+          # Kill all docker-proxy processes holding ports in the 3011+ range.
+          # The three-line approach only covered fixed ports; this catches whatever
+          # port the last deploy actually used.
+          pkill -9 -f 'docker-proxy.*30[0-9][0-9]' 2>/dev/null || true
+          sleep 5
 
           # Verify the postgrest container is actually gone before we pick a port.
           if docker ps -aq --filter "name=route_commerce_postgrest" | grep -q .; then