diff --git a/scripts/ci/deploy-qa.sh b/scripts/ci/deploy-qa.sh
index fdc7379..dffc4f6 100755
--- a/scripts/ci/deploy-qa.sh
+++ b/scripts/ci/deploy-qa.sh
@@ -24,9 +24,14 @@ $COMPOSE down -v
 log "Starting QA stack"
 $COMPOSE up -d
 
-log "Waiting for API health check via admin proxy on port $QA_ADMIN_PORT"
+log "Waiting for API health check via admin proxy"
+# Checked with `docker compose exec` rather than curling the published host
+# port: CI runs this script inside a runner container on its own bridge
+# network, where "localhost:$QA_ADMIN_PORT" is the runner's own loopback, not
+# the docker host's - it can never reach a host-published port. Exec'ing into
+# the admin container and curling its own localhost sidesteps that entirely.
 attempts=30
-until curl -fsS "http://localhost:${QA_ADMIN_PORT}/health" >/dev/null 2>&1; do
+until $COMPOSE exec -T admin curl -fsS http://localhost/health >/dev/null 2>&1; do
   attempts=$((attempts - 1))
   if [[ "$attempts" -le 0 ]]; then
     fail "QA stack did not become healthy in time"