diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index a9bc2ae..0c616a1 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -26,8 +26,12 @@ jobs:
     # PGDATA: the timescaledb-ha image initialises at /home/postgres/pgdata/data;
     # the healthcheck uses pg_isready, which doesn't depend on the PGDATA path.
     #
-    # Port mapping: 5432:5432 binds the service on the runner's loopback.
-    # The dry-run docker run uses --network host so DB_HOST=localhost reaches it.
+    # Port mapping: 15432:5432 — host port 15432 is the conventional
+    # Postgres-second-instance port. We deliberately do NOT use 5432 on the
+    # runner because the runner host typically has another Postgres on 5432
+    # (dev stack, stage instance) which would cause a port-allocation collision.
+    # The dry-run docker run uses --network host so DB_HOST=localhost reaches
+    # the service on the runner's loopback at port 15432.
     # ---------------------------------------------------------------------------
     services:
       postgres:
@@ -37,7 +41,7 @@ jobs:
           POSTGRES_PASSWORD: directus
           POSTGRES_DB: directus
         ports:
-          - '5432:5432'
+          - '15432:5432'
         options: >-
           --health-cmd "pg_isready -U directus -d directus"
           --health-interval 5s
@@ -93,7 +97,7 @@ jobs:
             --entrypoint bash \
             -e DB_CLIENT=pg \
             -e DB_HOST=localhost \
-            -e DB_PORT=5432 \
+            -e DB_PORT=15432 \
             -e DB_USER=directus \
             -e DB_PASSWORD=directus \
             -e DB_DATABASE=directus \
diff --git a/.planning/phase-1-slice-1-schema/08-gitea-ci-dryrun.md b/.planning/phase-1-slice-1-schema/08-gitea-ci-dryrun.md
index 44cfee6..accfc57 100644
--- a/.planning/phase-1-slice-1-schema/08-gitea-ci-dryrun.md
+++ b/.planning/phase-1-slice-1-schema/08-gitea-ci-dryrun.md
@@ -173,3 +173,5 @@ Pending live trigger (will validate on first push that hits the path filter):
 - `PORTAINER_WEBHOOK_URL` (optional) — for auto-redeploy on push
 
 Without `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` the Login step fails with a clear auth error. Without `PORTAINER_WEBHOOK_URL` the Portainer step is skipped entirely.
+
+**Port-allocation correction (2026-05-02):** initial workflow used `5432:5432` for the throwaway-Postgres port mapping. On a self-hosted Gitea runner, the host typically has another Postgres on 5432 (dev stack, stage instance), causing the service container to fail at start with "port already allocated." Fixed by remapping to `15432:5432` (the conventional Postgres-second-instance port) and updating the dry-run's `DB_PORT=15432`. The service container itself still listens on 5432 internally — only the host-side mapping changed. `--network host` semantics are preserved: `DB_HOST=localhost` reaches the service on the runner's loopback at `:15432`.