diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 1b16634..eeceeaf 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -384,29 +384,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build Docker image
-        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml build
-
-      - name: Boot server (SQLite, host networking)
+      - name: Run surface tests (compose)
         env:
           BUNDLED_PACKAGES: '*'
           ARMATURE_ADMIN_USERNAME: admin
           ARMATURE_ADMIN_PASSWORD: admin
           ARMATURE_ADMIN_EMAIL: admin@test.local
-        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d
-
-      - name: Wait for healthy
-        run: ./ci/wait-for-healthy.sh http://localhost:80 30
-
-      - name: Install Playwright
-        run: npx playwright install --with-deps chromium
-
-      - name: Run surface tests
-        env:
-          SERVER_URL: http://localhost:80
-          ADMIN_USER: admin
-          ADMIN_PASS: admin
-        run: ./ci/run-surface-tests.sh
+        run: |
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+            --abort-on-container-exit \
+            --exit-code-from test-runner
 
       - name: Teardown
         if: always()
diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml
index 343e7e6..9159888 100644
--- a/docker-compose.ci.yml
+++ b/docker-compose.ci.yml
@@ -1,7 +1,44 @@
-# CI override — uses host networking so the container is reachable
-# from the Gitea runner pod without cross-network routing.
+# docker-compose.ci.yml — CI test override
 #
-# Usage: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d
+# Extends base docker-compose.yml. Adds a healthcheck to armature and a
+# Playwright test-runner service.  All containers share the default compose
+# bridge network, so the test-runner reaches armature via Docker DNS
+# (http://armature:80).
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+#     --abort-on-container-exit --exit-code-from test-runner
+#
+# The workflow exits with the test-runner's exit code (0 = pass, 1 = fail).
+#
+# NOTE: Do NOT use network_mode: host — the workflow container and compose
+# containers are in separate network namespaces inside DinD. Use the default
+# bridge network and let services talk via Docker DNS instead.
+
 services:
   armature:
-    network_mode: host
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:80/api/v1/auth/login"]
+      interval: 2s
+      timeout: 3s
+      retries: 30
+      start_period: 5s
+
+  test-runner:
+    image: mcr.microsoft.com/playwright:v1.52.0-noble
+    depends_on:
+      armature:
+        condition: service_healthy
+    working_dir: /work
+    volumes:
+      - .:/work
+    environment:
+      SERVER_URL: http://armature:80
+      ADMIN_USER: admin
+      ADMIN_PASS: admin
+    command:
+      - bash
+      - -c
+      - |
+        npm install --no-save playwright 2>/dev/null
+        ./ci/run-surface-tests.sh