diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 3be9b0c..839b7b8 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -49,16 +49,22 @@ jobs:
           IMAGE_PATH=$(echo "git.elijahkuntz.com/${{ gitea.actor }}/${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')
           IMAGE_SHA="$IMAGE_PATH:${{ github.sha }}"
           CI_SECRET=$(openssl rand -hex 32)
+          SMOKE_CONTAINER="study-smoke-$(openssl rand -hex 8)"
+          cleanup_smoke() {
+            docker rm -f "$SMOKE_CONTAINER" > /dev/null 2>&1 || true
+          }
+          trap cleanup_smoke EXIT
           docker build -t "$IMAGE_SHA" .
-          docker run -d --name study-smoke -p 3000:3726 -e SESSION_SECRET="$CI_SECRET" -e ALLOW_INITIAL_SETUP=true "$IMAGE_SHA"
+          docker run -d --name "$SMOKE_CONTAINER" -e SESSION_SECRET="$CI_SECRET" -e ALLOW_INITIAL_SETUP=true "$IMAGE_SHA"
           for attempt in $(seq 1 30); do
-            if [ "$(docker inspect --format='{{.State.Health.Status}}' study-smoke)" = "healthy" ]; then break; fi
+            if [ "$(docker inspect --format='{{.State.Health.Status}}' "$SMOKE_CONTAINER")" = "healthy" ]; then break; fi
             sleep 2
           done
-          test "$(docker inspect --format='{{.State.Health.Status}}' study-smoke)" = "healthy"
-          curl --fail http://127.0.0.1:3000/login > /dev/null
-          curl --fail http://127.0.0.1:3000/api/auth/setup-status | grep '"setupRequired":true'
-          docker rm -f study-smoke
+          test "$(docker inspect --format='{{.State.Health.Status}}' "$SMOKE_CONTAINER")" = "healthy"
+          docker exec "$SMOKE_CONTAINER" node -e "fetch('http://127.0.0.1:3726/login').then(r => { if (!r.ok) process.exit(1) }).catch(() => process.exit(1))"
+          docker exec "$SMOKE_CONTAINER" node -e "fetch('http://127.0.0.1:3726/api/auth/setup-status').then(async r => { const body = await r.json(); if (!r.ok || body.setupRequired !== true) process.exit(1) }).catch(() => process.exit(1))"
+          cleanup_smoke
+          trap - EXIT
           docker tag "$IMAGE_SHA" "$IMAGE_PATH:latest"
           docker push "$IMAGE_SHA"
           docker push "$IMAGE_PATH:latest"