diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6f77196..6b18f96 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -346,6 +346,9 @@ jobs:
   fidelity:
     name: Import/export fidelity gate
     runs-on: ubuntu-latest
+    # A guard so a hung sidecar can never keep the job (and its containers)
+    # alive on the shared runner host; the suite itself finishes in ~1 min.
+    timeout-minutes: 10
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -380,6 +383,9 @@ jobs:
       # ports avoid colliding with anything else on the runner.
       - name: Start pinned pandoc + Gotenberg sidecars
         run: |
+          # Clear any leftovers from an earlier interrupted run so the named
+          # containers never collide, and nothing leaks on the shared host.
+          docker rm -f fidelity-pandoc fidelity-gotenberg 2>/dev/null || true
           docker run -d --name fidelity-pandoc -p 13030:3030 pandoc/core:3.6 server
           docker run -d --name fidelity-gotenberg -p 13000:3000 gotenberg/gotenberg:8
           GW=$(ip -4 route show default | awk '{print $3; exit}')
@@ -410,6 +416,13 @@ jobs:
           echo '--- pandoc ---'; docker logs fidelity-pandoc 2>&1 | tail -30 || true
           echo '--- gotenberg ---'; docker logs fidelity-gotenberg 2>&1 | tail -30 || true
 
+      # Always tear the sidecars down — they run on the shared runner host, so a
+      # leaked (especially Chromium-backed Gotenberg) container would waste its
+      # memory until the next run and break re-runs on the container name.
+      - name: Stop sidecars
+        if: always()
+        run: docker rm -f fidelity-pandoc fidelity-gotenberg 2>/dev/null || true
+
   images:
     name: Build container images
     # PR-only: on main the CD workflow builds and pushes the same images —