diff --git a/.gitea/workflows/server-docker-build.yml b/.gitea/workflows/server-docker-build.yml
index 96b1d0c..df8174d 100644
--- a/.gitea/workflows/server-docker-build.yml
+++ b/.gitea/workflows/server-docker-build.yml
@@ -68,10 +68,25 @@ jobs:
           chmod 600 ~/.ssh/deploy_key
           ssh-keyscan -p "$DEPLOY_PORT" "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
           ssh -i ~/.ssh/deploy_key -p "$DEPLOY_PORT" -o StrictHostKeyChecking=yes \
-            espressoframe_deployer@"$DEPLOY_HOST" \
-            'cd ~/espresso-frame && \
-             docker compose down --remove-orphans && \
-             docker ps -q --filter publish=8420 | xargs -r docker stop && \
-             docker ps -aq --filter publish=8420 | xargs -r docker rm && \
-             docker compose pull && \
-             docker compose up -d'
+            espressoframe_deployer@"$DEPLOY_HOST" bash -s <<'REMOTE'
+          set -e
+          cd ~/espresso-frame
+          docker compose down --remove-orphans
+          docker compose pull
+          # "down" returning doesn't guarantee the OS/docker-proxy has
+          # actually released port 8420 yet -- an immediate "up -d" right
+          # after (especially with "pull" a no-op because the image was
+          # already cached) can lose that race and fail with "port is
+          # already allocated", even though the exact same "up -d" run a
+          # few seconds later succeeds every time. Retry instead of
+          # guessing at a fixed sleep long enough to always cover it.
+          for i in $(seq 1 10); do
+            if docker compose up -d; then
+              exit 0
+            fi
+            echo "docker compose up -d failed (attempt $i/10) -- retrying in 3s"
+            sleep 3
+          done
+          echo "docker compose up -d did not succeed after 10 attempts"
+          exit 1
+          REMOTE