diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 587a999..da128fa 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -14,6 +14,11 @@ on:
 jobs:
   backend:
     runs-on: ubuntu-latest
+    env:
+      # Kafka advertises this host on its EXTERNAL listener. The test process runs in
+      # a job container, so "localhost" (the compose default, correct for a dev box)
+      # would point the client at itself after bootstrap.
+      KAFKA_EXTERNAL_HOST: host.docker.internal
     steps:
       - uses: actions/checkout@v4
 
@@ -34,9 +39,11 @@ jobs:
       - name: Wait for Kafka
         run: |
           for i in $(seq 1 90); do
+            # Probe the INTERNAL listener: the EXTERNAL one advertises
+            # host.docker.internal, which does not resolve inside the broker container.
             if docker compose exec -T kafka \
               /opt/kafka/bin/kafka-broker-api-versions.sh \
-              --bootstrap-server localhost:9092 >/dev/null 2>&1; then
+              --bootstrap-server kafka:29092 >/dev/null 2>&1; then
               echo "Kafka is ready"
               exit 0
             fi
diff --git a/docker-compose.yml b/docker-compose.yml
index 7f11e8b..300375e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -38,9 +38,15 @@ services:
     environment:
       KAFKA_NODE_ID: 1
       KAFKA_PROCESS_ROLES: broker,controller
-      KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
-      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9092
-      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT
+      KAFKA_LISTENERS: INTERNAL://0.0.0.0:29092,EXTERNAL://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
+      # A client bootstraps, then reconnects to whatever the broker advertises — so the
+      # advertised address must be resolvable from the client, not from the broker.
+      # Compose services use INTERNAL; anything outside vigilcare_net reaches the
+      # published port via EXTERNAL. KAFKA_EXTERNAL_HOST overrides "localhost" for CI,
+      # where dotnet test runs inside a container and must use host.docker.internal.
+      KAFKA_ADVERTISED_LISTENERS: INTERNAL://kafka:29092,EXTERNAL://${KAFKA_EXTERNAL_HOST:-localhost}:9092
+      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: INTERNAL:PLAINTEXT,EXTERNAL:PLAINTEXT,CONTROLLER:PLAINTEXT
+      KAFKA_INTER_BROKER_LISTENER_NAME: INTERNAL
       KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
       KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
       KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1