diff --git a/scripts/e2e/import-appwrite.sh b/scripts/e2e/import-appwrite.sh
index e62a81346..46d593457 100755
--- a/scripts/e2e/import-appwrite.sh
+++ b/scripts/e2e/import-appwrite.sh
@@ -12,7 +12,8 @@ ROOT=$(pwd)
 export TMPDIR="$W"
 export FIXTURE_PASSWORD
 FIXTURE_PASSWORD=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')
-export FIXTURE_PORT=${FIXTURE_PORT:-$((22000 + RANDOM % 20000))}
+# Fixture ports stay below 32768, the bottom of the Linux ephemeral range: a higher port can be taken by an outbound connection (image pulls) between pick and bind.
+export FIXTURE_PORT=${FIXTURE_PORT:-$((20000 + RANDOM % 10000))}
 export TARGET_PG_PORT=$((FIXTURE_PORT + 2)) TARGET_HASURA_PORT=$((FIXTURE_PORT + 3)) TARGET_AUTH_PORT=$((FIXTURE_PORT + 4)) TARGET_HTTP_PORT=$((FIXTURE_PORT + 5)) TARGET_HTTPS_PORT=$((FIXTURE_PORT + 6))
 export SEAWEEDFS_PORT=$((FIXTURE_PORT + 7))
 FIXTURE=$ROOT/test/fixtures/import/appwrite/compose.yml
diff --git a/scripts/e2e/import-firebase.sh b/scripts/e2e/import-firebase.sh
index ae90c68fc..56eeb91c3 100644
--- a/scripts/e2e/import-firebase.sh
+++ b/scripts/e2e/import-firebase.sh
@@ -13,7 +13,8 @@ export TMPDIR="$W"
 # nself build generates the local TLS certificate with openssl when mkcert is absent.
 command -v openssl >/dev/null 2>&1 || apk add -q openssl >/dev/null 2>&1 || true
 rand() { od -An -N"$1" -tx1 /dev/urandom | tr -d ' \n'; }
-BASE=${FB_BASE_PORT:-$((22000 + RANDOM % 20000))}
+# Fixture ports stay below 32768, the bottom of the Linux ephemeral range: a higher port can be taken by an outbound connection (image pulls) between pick and bind.
+BASE=${FB_BASE_PORT:-$((20000 + RANDOM % 10000))}
 export FB_FIRESTORE_PORT=$BASE FB_AUTH_PORT=$((BASE + 1)) FB_STORAGE_PORT=$((BASE + 2))
 export SEAWEEDFS_PORT=$((BASE + 8))
 export TARGET_PG_PORT=$((BASE + 3)) TARGET_HASURA_PORT=$((BASE + 4)) TARGET_AUTH_PORT=$((BASE + 5)) TARGET_HTTP_PORT=$((BASE + 6)) TARGET_HTTPS_PORT=$((BASE + 7))
diff --git a/scripts/e2e/import-hasura-cloud.sh b/scripts/e2e/import-hasura-cloud.sh
index d43ed00b6..a366d6d3b 100644
--- a/scripts/e2e/import-hasura-cloud.sh
+++ b/scripts/e2e/import-hasura-cloud.sh
@@ -16,7 +16,8 @@ FIXTURE=$ROOT/test/fixtures/import/hasura-cloud
 export FIXTURE_PASSWORD FIXTURE_ADMIN_SECRET
 FIXTURE_PASSWORD=$(python3 -c 'import secrets;print(secrets.token_hex(24))')
 FIXTURE_ADMIN_SECRET=$(python3 -c 'import secrets;print(secrets.token_hex(24))')
-export FIXTURE_PORT=${FIXTURE_PORT:-$((22000 + RANDOM % 20000))}
+# Fixture ports stay below 32768, the bottom of the Linux ephemeral range: a higher port can be taken by an outbound connection (image pulls) between pick and bind.
+export FIXTURE_PORT=${FIXTURE_PORT:-$((20000 + RANDOM % 10000))}
 export FIXTURE_HASURA_PORT=$((FIXTURE_PORT + 1))
 export TARGET_PG_PORT=$((FIXTURE_PORT + 2)) TARGET_HASURA_PORT=$((FIXTURE_PORT + 3)) TARGET_AUTH_PORT=$((FIXTURE_PORT + 4)) TARGET_HTTP_PORT=$((FIXTURE_PORT + 5)) TARGET_HTTPS_PORT=$((FIXTURE_PORT + 6))
 PROJECT=a11hc-$(date +%s)-$RANDOM
diff --git a/scripts/e2e/import-nhost.sh b/scripts/e2e/import-nhost.sh
index 425201399..dfcd9cb95 100644
--- a/scripts/e2e/import-nhost.sh
+++ b/scripts/e2e/import-nhost.sh
@@ -16,7 +16,8 @@ FIXTURE=$ROOT/test/fixtures/import/nhost
 rand() { python3 -c 'import secrets;print(secrets.token_hex(24))'; }
 export FIXTURE_PASSWORD FIXTURE_ADMIN_SECRET FIXTURE_JWT_KEY FIXTURE_S3_ACCESS FIXTURE_S3_SECRET FIXTURE_S3_BUCKET=nhost
 FIXTURE_PASSWORD=$(rand) FIXTURE_ADMIN_SECRET=$(rand) FIXTURE_JWT_KEY=$(rand) FIXTURE_S3_ACCESS=$(rand) FIXTURE_S3_SECRET=$(rand)
-export FIXTURE_PORT=${FIXTURE_PORT:-$((22000 + RANDOM % 20000))}
+# Fixture ports stay below 32768, the bottom of the Linux ephemeral range: a higher port can be taken by an outbound connection (image pulls) between pick and bind.
+export FIXTURE_PORT=${FIXTURE_PORT:-$((20000 + RANDOM % 10000))}
 export FIXTURE_HASURA_PORT=$((FIXTURE_PORT + 1)) FIXTURE_AUTH_PORT=$((FIXTURE_PORT + 7)) FIXTURE_STORAGE_PORT=$((FIXTURE_PORT + 8)) FIXTURE_S3_PORT=$((FIXTURE_PORT + 9))
 export TARGET_PG_PORT=$((FIXTURE_PORT + 2)) TARGET_HASURA_PORT=$((FIXTURE_PORT + 3)) TARGET_AUTH_PORT=$((FIXTURE_PORT + 4)) TARGET_HTTP_PORT=$((FIXTURE_PORT + 5)) TARGET_HTTPS_PORT=$((FIXTURE_PORT + 6)) TARGET_S3_PORT=$((FIXTURE_PORT + 10))
 PROJECT=a11nh-$(date +%s)-$RANDOM
diff --git a/scripts/e2e/import-postgres.sh b/scripts/e2e/import-postgres.sh
index 84ce8cb1e..a7c70e362 100644
--- a/scripts/e2e/import-postgres.sh
+++ b/scripts/e2e/import-postgres.sh
@@ -7,7 +7,8 @@ ROOT=$(pwd)
 export TMPDIR="$W"
 export FIXTURE_PASSWORD
 FIXTURE_PASSWORD=$(python3 -c 'import secrets;print(secrets.token_hex(24))')
-export FIXTURE_PORT=${FIXTURE_PORT:-$((22000 + RANDOM % 20000))}
+# Fixture ports stay below 32768, the bottom of the Linux ephemeral range: a higher port can be taken by an outbound connection (image pulls) between pick and bind.
+export FIXTURE_PORT=${FIXTURE_PORT:-$((20000 + RANDOM % 10000))}
 export FIXTURE17_PORT=${FIXTURE17_PORT:-$((FIXTURE_PORT + 1))}
 export TARGET_PG_PORT=$((FIXTURE_PORT + 2)) TARGET_HASURA_PORT=$((FIXTURE_PORT + 3)) TARGET_AUTH_PORT=$((FIXTURE_PORT + 4)) TARGET_HTTP_PORT=$((FIXTURE_PORT + 5)) TARGET_HTTPS_PORT=$((FIXTURE_PORT + 6))
 FIXTURE=$ROOT/test/fixtures/import/postgres/compose.yml
diff --git a/scripts/e2e/import-supabase.sh b/scripts/e2e/import-supabase.sh
index 56f96b615..2e16e8cd1 100755
--- a/scripts/e2e/import-supabase.sh
+++ b/scripts/e2e/import-supabase.sh
@@ -27,7 +27,8 @@ FIXTURE_PASSWORD=$(rand 24)
 FIXTURE_JWT_SECRET=$(rand 32)
 FIXTURE_ANON_KEY=$(jwt anon)
 FIXTURE_SERVICE_KEY=$(jwt service_role)
-export FIXTURE_PORT=${FIXTURE_PORT:-$((22000 + RANDOM % 20000))}
+# Fixture ports stay below 32768, the bottom of the Linux ephemeral range: a higher port can be taken by an outbound connection (image pulls) between pick and bind.
+export FIXTURE_PORT=${FIXTURE_PORT:-$((20000 + RANDOM % 10000))}
 export FIXTURE_AUTH_PORT=$((FIXTURE_PORT + 1))
 export TARGET_PG_PORT=$((FIXTURE_PORT + 2)) TARGET_HASURA_PORT=$((FIXTURE_PORT + 3)) TARGET_AUTH_PORT=$((FIXTURE_PORT + 4)) TARGET_HTTP_PORT=$((FIXTURE_PORT + 5)) TARGET_HTTPS_PORT=$((FIXTURE_PORT + 6)) TARGET_S3_PORT=$((FIXTURE_PORT + 7))
 export FIXTURE_STORAGE_PORT=$((FIXTURE_PORT + 8))