diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index f4b68d6..9b90467 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -249,14 +249,18 @@ jobs:
           set -eux
           echo "=== container landscape (diagnostic for the name filter) ==="
           docker ps -a --format '{{.ID}} {{.Image}} -> {{.Names}}'
-          # Only THIS job's Postgres. Other repos' integration jobs share the runner, and
-          # `name=integration` alone once picked one of theirs (run 8653: a different
-          # password). act names a job's containers GITEA-ACTIONS-TASK-<task id>-..., and
-          # the job container's hostname is its own container id.
-          TASK=$(docker inspect -f '{{.Name}}' "$(cat /etc/hostname)" | sed -n 's|^/\(GITEA-ACTIONS-TASK-[0-9]*-\).*|\1|p')
+          # Only THIS job's services. The runner's docker daemon is shared, so another
+          # repo's job can be running beside this one, and a job-name filter matches its
+          # containers too (Steward run 8358 and Inkwell run 8653 each took another repo's
+          # Postgres). act names every container of a task GITEA-ACTIONS-TASK-<n>-...: read
+          # <n> from our own container (its id is in the /etc/hostname bind mount) and
+          # require exactly one match.
+          SELF=$(grep -o '/containers/[0-9a-f]\{64\}/' /proc/self/mountinfo | head -n1 | cut -d/ -f3 || true)
+          SELF=${SELF:-$(hostname)}
+          TASK=$(docker inspect -f '{{.Name}}' "$SELF" | grep -o 'GITEA-ACTIONS-TASK-[0-9]*-')
           test -n "$TASK"
           PG=$(docker ps --filter "name=$TASK" --filter "ancestor=postgres:16-alpine" -q)
-          test "$(echo "$PG" | wc -w)" -eq 1
+          test "$(printf '%s\n' "$PG" | grep -c .)" -eq 1
           PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG")
           test -n "$PG_IP"
           export INKWELL_DATABASE_URL="postgresql+asyncpg://inkwell:ci_integration@${PG_IP}:5432/inkwell_test"