diff --git a/e2e-playground/README.md b/e2e-playground/README.md
index 4c99c644..337bfe1e 100644
--- a/e2e-playground/README.md
+++ b/e2e-playground/README.md
@@ -26,6 +26,32 @@ From the repository root:
 make e2e-playground
 ```
 
+### If a host port is already taken
+
+The mock services publish fixed host ports, and the suite fails at startup if
+one is in use by something else on your machine:
+
+```
+Error response from daemon: Ports are not available: exposing port TCP
+0.0.0.0:4100 -> 0.0.0.0:0: listen tcp 0.0.0.0:4100: bind: address already in use
+```
+
+Override just that one — the defaults are unchanged, and nothing inside the
+stack is affected because services reach each other over the compose network
+(`http://sms-sink:4100`), not via the host:
+
+```bash
+SMS_SINK_HOST_PORT=4102 make e2e-playground
+```
+
+| Variable | Default | Service |
+| --- | --- | --- |
+| `MOCK_OAUTH_HOST_PORT` | 4000 | mock-oauth |
+| `MOCK_SAML_IDP_HOST_PORT` | 4001 | mock-saml-idp |
+| `SMS_SINK_HOST_PORT` | 4100 | sms-sink |
+| `WEBHOOK_SINK_HOST_PORT` | 4200 | webhook-sink |
+| `CIMD_CLIENT_HOST_PORT` | 4300 | cimd-client |
+
 This builds and starts the full docker-compose stack (six `authorizer` instances configured for different scenarios, the mock OAuth/SAML/SMS/webhook servers, Mailpit for email), runs the entire Playwright suite in a containerized runner, and **always** tears the stack down afterward (`docker compose down -v`) — including on failure or if the stack fails to start.
 
 Equivalent to, run manually:
diff --git a/e2e-playground/docker-compose.yml b/e2e-playground/docker-compose.yml
index f75ff02f..ccc2ab80 100644
--- a/e2e-playground/docker-compose.yml
+++ b/e2e-playground/docker-compose.yml
@@ -568,15 +568,15 @@ services:
 
   mock-oauth:
     build: ./mocks/mock-oauth
-    ports: ["4000:4000"]
+    ports: ["${MOCK_OAUTH_HOST_PORT:-4000}:4000"]
 
   mock-saml-idp:
     build: ./mocks/mock-saml-idp
-    ports: ["4001:4001"]
+    ports: ["${MOCK_SAML_IDP_HOST_PORT:-4001}:4001"]
 
   sms-sink:
     build: ./mocks/sms-sink
-    ports: ["4100:4100"]
+    ports: ["${SMS_SINK_HOST_PORT:-4100}:4100"]
 
   # One-shot: generates a CA and a leaf certificate into the shared `certs`
   # volume, then exits. Everything that needs TLS waits on it completing.
@@ -594,11 +594,11 @@ services:
       tls-certs: { condition: service_completed_successfully }
     volumes:
       - certs:/certs
-    ports: ["4300:4300"]
+    ports: ["${CIMD_CLIENT_HOST_PORT:-4300}:4300"]
 
   webhook-sink:
     build: ./mocks/webhook-sink
-    ports: ["4200:4200"]
+    ports: ["${WEBHOOK_SINK_HOST_PORT:-4200}:4200"]
 
   mailpit:
     image: axllent/mailpit:latest