diff --git a/.github/workflows/docker-ci.yml b/.github/workflows/docker-ci.yml
index 8ebeb1c..040c4d8 100644
--- a/.github/workflows/docker-ci.yml
+++ b/.github/workflows/docker-ci.yml
@@ -23,24 +23,25 @@ jobs:
       # ── Write a minimal .env consumed by docker-compose.yml ───────────────
       - name: Write .env
         run: |
-          cat > .env <<'EOF'
-          SECRET_KEY=ci-only-secret-key-not-for-production
-          SQLITE_PATH=/app/data/homelab.db
-          CORS_ORIGINS=["http://localhost:3000"]
-          SCANNER_RANGES=["127.0.0.1/32"]
-          STATUS_CHECKER_INTERVAL=300
-          MCP_API_KEY=ci-mcp-key
-          MCP_SERVICE_KEY=ci-svc-key
-          AUTH_USERNAME=admin
-          EOF
-          echo "AUTH_PASSWORD_HASH=${{ steps.pwhash.outputs.hash }}" >> .env
+          {
+            echo "SECRET_KEY=ci-only-secret-key-not-for-production"
+            echo "SQLITE_PATH=/app/data/homelab.db"
+            echo 'CORS_ORIGINS=["http://localhost:3000"]'
+            echo 'SCANNER_RANGES=["127.0.0.1/32"]'
+            echo "STATUS_CHECKER_INTERVAL=300"
+            echo "MCP_API_KEY=ci-mcp-key"
+            echo "MCP_SERVICE_KEY=ci-svc-key"
+            echo "AUTH_USERNAME=admin"
+            echo "AUTH_PASSWORD_HASH=${{ steps.pwhash.outputs.hash }}"
+          } > .env
 
       # ── Build + start backend and frontend (skip mcp) ─────────────────────
+      # docker-compose.ci.yml adds ports: 8000:8000 so the runner can reach the backend
       - name: Build images
-        run: docker compose build backend frontend
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml build backend frontend
 
       - name: Start stack
-        run: docker compose up -d backend frontend
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d backend frontend
 
       # ── Wait for backend to be healthy (max 60 s) ─────────────────────────
       - name: Wait for backend health
@@ -83,8 +84,8 @@ jobs:
       # ── Teardown ───────────────────────────────────────────────────────────
       - name: Dump logs on failure
         if: failure()
-        run: docker compose logs
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml logs
 
       - name: Stop stack
         if: always()
-        run: docker compose down -v
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v
diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml
new file mode 100644
index 0000000..dd464c4
--- /dev/null
+++ b/docker-compose.ci.yml
@@ -0,0 +1,6 @@
+# CI override — exposes backend port 8000 so smoke/integration tests can reach it.
+# Usage: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d backend frontend
+services:
+  backend:
+    ports:
+      - "8000:8000"
diff --git a/scripts/lxc-install.sh b/scripts/lxc-install.sh
index 3798939..9a9c00a 100755
--- a/scripts/lxc-install.sh
+++ b/scripts/lxc-install.sh
@@ -10,7 +10,6 @@ INSTALL_DIR=/opt/homelable
 DATA_DIR=/opt/homelable/data
 SERVICE_USER=homelable
 REPO_URL="https://github.com/Pouzor/homelable.git"
-RAW="https://raw.githubusercontent.com/Pouzor/homelable/main"
 
 RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
 info()  { echo -e "${GREEN}[homelable]${NC} $*"; }
@@ -20,7 +19,12 @@ error() { echo -e "${RED}[homelable]${NC} $*"; exit 1; }
 [[ $EUID -ne 0 ]] && error "Run as root (sudo bash ...)"
 
 # ── Detect OS ─────────────────────────────────────────────────────────────────
-[[ -f /etc/os-release ]] && . /etc/os-release || error "Cannot detect OS"
+if [[ -f /etc/os-release ]]; then
+  # shellcheck source=/dev/null
+  . /etc/os-release
+else
+  error "Cannot detect OS"
+fi
 info "Detected: $PRETTY_NAME"
 [[ "$ID" =~ ^(debian|ubuntu)$ ]] || error "Requires Debian or Ubuntu"
 
@@ -118,7 +122,11 @@ sed \
 
 ln -sf /etc/nginx/sites-available/homelable /etc/nginx/sites-enabled/homelable
 rm -f /etc/nginx/sites-enabled/default
-nginx -t && systemctl reload nginx || systemctl start nginx
+if nginx -t; then
+  systemctl reload nginx
+else
+  systemctl start nginx
+fi
 
 # ── Enable & start ────────────────────────────────────────────────────────────
 systemctl daemon-reload