diff --git a/action.yml b/action.yml
index 984c118..064a189 100644
--- a/action.yml
+++ b/action.yml
@@ -41,11 +41,9 @@ runs:
         # If it is already running with the right config, keep it (warm cache).
         if [ "$(docker inspect -f '{{.State.Running}}' ${{ inputs.container_name }} 2>/dev/null)" != "true" ]; then
           docker rm -f ${{ inputs.container_name }} >/dev/null 2>&1 || true
-          # NOTE: no -p publish needed — the job executor itself runs on the
-          # same docker network, so it reaches buildkitd by container DNS name.
-          # (127.0.0.1 inside the executor is its own loopback, NOT the host's.)
           docker run -d --name ${{ inputs.container_name }} --privileged \
             --network ${{ inputs.network }} \
+            -p 127.0.0.1:${{ inputs.port }}:${{ inputs.port }} \
             --restart unless-stopped \
             --label com.centurylinklabs.watchtower.monitor-only=${{ inputs.monitor_only }} \
             --label dockhand.notify=${{ inputs.dockhand_notify }} \
@@ -56,7 +54,10 @@ runs:
       uses: docker/setup-buildx-action@v4
       with:
         driver: remote
-        endpoint: tcp://${{ inputs.container_name }}:${{ inputs.port }}
+        # The act_runner executor runs with network=host (confirmed in runner
+        # logs), so it reaches buildkitd via the host-published loopback port.
+        # Docker DNS names are NOT resolvable from the host namespace.
+        endpoint: tcp://127.0.0.1:${{ inputs.port }}
 
     - name: Stop BuildKit (idle cleanup)
       if: ${{ inputs.cleanup == 'true' && always() }}