diff --git a/deploy/docker-compose.test.yml b/deploy/docker-compose.test.yml
index 9881591..8225f28 100644
--- a/deploy/docker-compose.test.yml
+++ b/deploy/docker-compose.test.yml
@@ -616,7 +616,12 @@ services:
       dockerfile: deploy/test/f5-mock-icontrol/Dockerfile
     container_name: certctl-test-f5-mock
     ports:
-      - "20443:443"
+      # Host port 20449 (NOT 20443 — apache-test owns 20443). The
+      # ci-pipeline-cleanup Phase 5 vendor-matrix collapse brings up
+      # all sidecars simultaneously; the original Phase 1 design
+      # accidentally double-bound 20443 because the per-vendor matrix
+      # only ever ran one sidecar at a time, hiding the collision.
+      - "20449:443"
     networks:
       certctl-test:
         ipv4_address: 10.30.50.28
diff --git a/deploy/test/vendor_e2e_helpers.go b/deploy/test/vendor_e2e_helpers.go
index 769704d..f6b3b98 100644
--- a/deploy/test/vendor_e2e_helpers.go
+++ b/deploy/test/vendor_e2e_helpers.go
@@ -52,7 +52,7 @@ var sidecarMap = map[string]vendorSidecar{
 	"postfix":     {name: "postfix-test", hostPort: "127.0.0.1:20465"},
 	"dovecot":     {name: "dovecot-test", hostPort: "127.0.0.1:20993"},
 	"openssh":     {name: "openssh-test", hostPort: "127.0.0.1:20022"},
-	"f5-mock":     {name: "f5-mock-icontrol", hostPort: "127.0.0.1:20443"},
+	"f5-mock":     {name: "f5-mock-icontrol", hostPort: "127.0.0.1:20449"},
 	"k8s-kind":    {name: "k8s-kind-test", hostPort: ""},
 	"windows-iis": {name: "windows-iis-test", hostPort: "127.0.0.1:20448"},
 }