diff --git a/site-cookbooks/kosmos_gitea/CHANGELOG.md b/site-cookbooks/kosmos_gitea/CHANGELOG.md
index c6cfb95..5f8de4f 100644
--- a/site-cookbooks/kosmos_gitea/CHANGELOG.md
+++ b/site-cookbooks/kosmos_gitea/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.5
+
+- Stop pinning job containers to one shared Docker network. `container.network`
+  is empty again, so the runner auto-creates an isolated bridge network per job:
+  concurrent jobs keep service-container DNS (e.g. `redis`) but can no longer
+  resolve each other's service containers, fixing intermittent cross-job CI
+  failures. `cache.host` is auto-detected, and the cache firewall rule now allows
+  Docker's default address pool (`172.16.0.0/12`).
+- Remove the now-unused `gitea-actions` network on converge (once idle).
+
 # 0.3.4
 
 - Upgrade the Gitea Actions runner from 5.0.0 to 5.2.2. No `config.yaml` changes
diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb
index f7308b8..dc38e59 100644
--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -32,11 +32,17 @@ node.default["gitea"]["runner"]["config"] = {
     "capacity" => 2
   },
   "container" => {
-    "network" => "gitea-actions" # User-defined bridge network: provides DNS for service containers
+    # Empty: the runner auto-creates an isolated user-defined network per job, so
+    # each job gets its own embedded DNS. Concurrent jobs can no longer collide on
+    # service container names (e.g. two jobs both exposing a host named `redis`).
+    "network" => ""
   },
   "cache" => {
     "enabled" => true,
-    "host"    => "172.20.0.1" # Gateway of the gitea-actions network, reachable from job containers
+    # Empty: auto-detect the host address reachable from job containers. The runner
+    # is a host binary (not containerized), so a per-job network resolves this to a
+    # reachable gateway. Set explicitly only if detection picks a wrong interface.
+    "host"    => ""
     # Port is set per-runner (cache_base_port + index) in the runner recipe
   }
 }
diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb
index a847057..2b17f77 100644
--- a/site-cookbooks/kosmos_gitea/metadata.rb
+++ b/site-cookbooks/kosmos_gitea/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.4'
+version '0.3.5'
 chef_version '>= 14.0'
 
 depends "firewall"
diff --git a/site-cookbooks/kosmos_gitea/recipes/runner.rb b/site-cookbooks/kosmos_gitea/recipes/runner.rb
index 1833aa0..dee250f 100644
--- a/site-cookbooks/kosmos_gitea/recipes/runner.rb
+++ b/site-cookbooks/kosmos_gitea/recipes/runner.rb
@@ -38,9 +38,12 @@ directory "#{working_directory}/runners" do
   mode  "0700"
 end
 
-execute "create_gitea_actions_network" do
-  command "docker network create --subnet 172.20.0.0/16 gitea-actions"
-  not_if  "docker network inspect gitea-actions"
+# One-time cleanup of the previously shared bridge network. Skipped while jobs are
+# still attached; the next converge removes it once the runner is idle.
+execute "remove_gitea_actions_network" do
+  command "docker network rm gitea-actions"
+  only_if "docker network inspect gitea-actions"
+  not_if  "docker network inspect -f '{{len .Containers}}' gitea-actions | grep -qv '^0$'"
 end
 
 runners.each_with_index do |runner, index|
@@ -59,7 +62,9 @@ runners.each_with_index do |runner, index|
     command  :allow
     port     cache_port
     protocol :tcp
-    source   "172.20.0.0/16"
+    # Job containers now run on auto-created per-job networks, which Docker
+    # allocates from its default address pool (172.16.0.0/12).
+    source   "172.16.0.0/12"
   end
 
   template "#{runner_dir}/config.yaml" do