diff --git a/.gitea/workflows/hub-check.yml b/.gitea/workflows/hub-check.yml
index 2e934cb..6c7047f 100644
--- a/.gitea/workflows/hub-check.yml
+++ b/.gitea/workflows/hub-check.yml
@@ -20,9 +20,9 @@ jobs:
           POSTGRES_USER: paradigm
           POSTGRES_PASSWORD: paradigm
           POSTGRES_DB: cph_hub_test
-        ports:
-          # Host 15432 avoids collisions with any runner-local Postgres on 5432.
-          - 15432:5432
+        # Avoid host-port binds: concurrent hub-check jobs on the same runner
+        # raced on 5432/15432 ("port is already allocated"). Reach the service
+        # by Docker DNS name from the job container instead.
         options: >-
           --health-cmd "pg_isready -U paradigm -d cph_hub_test"
           --health-interval 5s
@@ -49,15 +49,15 @@ jobs:
 
       - name: Install Linux sandbox dependency
         run: sudo apt-get update && sudo apt-get install --yes bubblewrap socat
-
       - name: Wait for Postgres
         run: |
           node <<'NODE'
           const net = require("node:net");
           const deadline = Date.now() + 60000;
-          const port = Number(process.env.HUB_CHECK_PG_PORT || "15432");
+          const host = process.env.HUB_CHECK_PG_HOST || "postgres";
+          const port = Number(process.env.HUB_CHECK_PG_PORT || "5432");
           function tryConnect() {
-            const socket = net.createConnection({ host: "127.0.0.1", port });
+            const socket = net.createConnection({ host, port });
             socket.once("connect", () => {
               socket.end();
               process.exit(0);
@@ -65,7 +65,7 @@ jobs:
             socket.once("error", () => {
               socket.destroy();
               if (Date.now() > deadline) {
-                console.error(`Postgres did not become reachable at 127.0.0.1:${port}`);
+                console.error(`Postgres did not become reachable at ${host}:${port}`);
                 process.exit(1);
               }
               setTimeout(tryConnect, 1000);
@@ -110,7 +110,7 @@ jobs:
           npx prisma migrate deploy --schema prisma/schema.prisma
           npx vitest run test/integration \
             --exclude test/integration/real-model.test.ts \
-            --exclude test/integration/agent-sandbox-linux.test.ts
+          DATABASE_URL: postgresql://paradigm:paradigm@postgres:5432/cph_hub_test
         env:
           DATABASE_URL: postgresql://paradigm:paradigm@127.0.0.1:15432/cph_hub_test