diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 463838f..a27802a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,9 @@ permissions:
 jobs:
   validate:
     name: Validate Docker Configs
-    runs-on: [self-hosted, linux, arm64]
+    # GitHub-hosted: hadolint-action pulls ghcr.io/hadolint/hadolint which needs
+    # authenticated GHCR access; GitHub-hosted runners have ambient auth, self-hosted ARM do not.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
index a7d7c00..09e33fc 100644
--- a/.github/workflows/deploy-production.yml
+++ b/.github/workflows/deploy-production.yml
@@ -91,6 +91,9 @@ jobs:
             COMPOSE_DIR=$(docker inspect "$CONTAINER" --format '{{ index .Config.Labels "com.docker.compose.project.working_dir" }}' 2>/dev/null || echo "")
             if [ -n "$COMPOSE_DIR" ] && [ -d "$COMPOSE_DIR" ]; then
               cd "$COMPOSE_DIR"
+              # Remove stale container before recreate to prevent Docker naming conflicts
+              # (container_name + compose project-hash alias can collide on --force-recreate)
+              docker rm -f dakera 2>/dev/null || true
               # Force-recreate minio so new resource limits (cpus/memory) take effect
               DAKERA_IMAGE=ghcr.io/dakera-ai/dakera:${{ inputs.version }} docker compose up -d --force-recreate minio minio-setup dakera
             else