diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6b18f96..b745983 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -377,34 +377,34 @@ jobs:
         run: pnpm --filter @dorfteich/api exec prisma generate
 
       # Start the pinned sidecars with `docker run` (pandoc-server needs the
-      # `server` arg, which Actions `services:` cannot pass). Their published
-      # ports are reached from this job container via the Docker host gateway —
-      # robust regardless of the runner's per-job network name. Uncommon host
-      # ports avoid colliding with anything else on the runner.
+      # `server` arg, which Actions `services:` cannot pass) and attach them to
+      # THIS job container's network namespace, so they are reachable at
+      # localhost — no dependency on `ip`/gateway routing (the minimal runner
+      # image has no iproute2). Sharing the netns means no published ports.
       - name: Start pinned pandoc + Gotenberg sidecars
         run: |
           # Clear any leftovers from an earlier interrupted run so the named
           # containers never collide, and nothing leaks on the shared host.
           docker rm -f fidelity-pandoc fidelity-gotenberg 2>/dev/null || true
-          docker run -d --name fidelity-pandoc -p 13030:3030 pandoc/core:3.6 server
-          docker run -d --name fidelity-gotenberg -p 13000:3000 gotenberg/gotenberg:8
-          GW=$(ip -4 route show default | awk '{print $3; exit}')
-          echo "SIDECAR_HOST=$GW" >> "$GITHUB_ENV"
+          JOB_ID=$(cat /etc/hostname)
+          docker run -d --name fidelity-pandoc \
+            --network "container:${JOB_ID}" pandoc/core:3.6 server
+          docker run -d --name fidelity-gotenberg \
+            --network "container:${JOB_ID}" gotenberg/gotenberg:8
           for i in $(seq 1 30); do
-            curl -sf "http://$GW:13030/version" >/dev/null && break
+            curl -sf http://localhost:3030/version >/dev/null && break
             sleep 1
           done
           for i in $(seq 1 30); do
-            curl -sf "http://$GW:13000/health" >/dev/null && break
+            curl -sf http://localhost:3000/health >/dev/null && break
             sleep 1
           done
-          curl -sf "http://$GW:13030/version"
-          curl -sf "http://$GW:13000/health"
+          curl -sf http://localhost:3030/version
+          curl -sf http://localhost:3000/health
 
       - name: Run fidelity suite (import + export snapshots, PDF smoke)
         run: |
-          PANDOC_URL="http://${SIDECAR_HOST}:13030" \
-          GOTENBERG_URL="http://${SIDECAR_HOST}:13000" \
+          PANDOC_URL=http://localhost:3030 GOTENBERG_URL=http://localhost:3000 \
             pnpm --filter @dorfteich/api exec vitest run \
               src/import-export/import.fixtures.test.ts \
               src/import-export/export.fidelity.test.ts \