diff --git a/docker/chatmail_relay.dockerfile b/docker/chatmail_relay.dockerfile
index dfb38ed4..e38282fe 100644
--- a/docker/chatmail_relay.dockerfile
+++ b/docker/chatmail_relay.dockerfile
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 FROM jrei/systemd-debian:12 AS base
 
 ENV LANG=en_US.UTF-8
diff --git a/docker/files/chatmail-init.sh b/docker/files/chatmail-init.sh
index 51132bb7..8ae846d5 100755
--- a/docker/files/chatmail-init.sh
+++ b/docker/files/chatmail-init.sh
@@ -49,6 +49,16 @@ if [ -z "${CMDEPLOY_STAGES:-}" ] \
     && [ "$(cat "$FINGERPRINT_FILE")" = "$current_fp" ]; then
     echo "[INFO] No changes detected ($current_fp), skipping deploy."
 else
+    # Stop chatmail services so the port check sees a clean state.
+    # (ss -p inside Docker can't always identify processes, causing false
+    # "port occupied" failures.) The activate stage will restart them.
+    echo "[INFO] Stopping services for clean port check..."
+    systemctl stop postfix dovecot nginx opendkim unbound \
+        filtermail doveauth chatmail-metadata iroh-relay mtail fcgiwrap 2>/dev/null || true
+
+    # Show listening ports before deploy (diagnostic for port-check failures)
+    echo "[DEBUG] Listening ports before deploy:"
+    ss -lptn | while IFS= read -r line; do echo "  $line"; done
     export CMDEPLOY_STAGES="${CMDEPLOY_STAGES:-configure,activate}"
     $CMDEPLOY run --config "$CHATMAIL_INI" --ssh-host @local
     echo "$current_fp" > "$FINGERPRINT_FILE"