diff --git a/docker/gvm-test/compose.yaml b/docker/gvm-test/compose.yaml
index da481a8..e039a8a 100644
--- a/docker/gvm-test/compose.yaml
+++ b/docker/gvm-test/compose.yaml
@@ -176,8 +176,8 @@ services:
     image: registry.community.greenbone.net/community/nginx@sha256:53bfde7e5db20cef57c2b8a9ca654a08803614193c929248f43dfd8293fd34d1
     container_name: ukrrs-oam-gvm-nginx
     ports:
-      - 127.0.0.1:443:443
-      - 127.0.0.1:9392:9392
+      - 127.0.0.1:19443:443   # host ports 80/443 are claimed by the k3s ingress (hostPort) on this node
+      - 127.0.0.1:19392:9392
     volumes:
       - nginx_config_vol:/etc/nginx/conf.d:ro
       - nginx_certificates_vol:/etc/nginx/certs:ro
diff --git a/openvas/README.md b/openvas/README.md
index cf91370..de15554 100644
--- a/openvas/README.md
+++ b/openvas/README.md
@@ -43,7 +43,7 @@ GLPI CMDB (computers, read-only via mglpi identity)
 
 `docker/gvm-test/compose.yaml` = the OFFICIAL Greenbone compose (fetched
 2026-09-05 from https://greenbone.github.io/docs/latest/_static/compose.yaml,
-already loopback-bound: 127.0.0.1:443 + 127.0.0.1:9392). Registry:
+loopback-bound: **127.0.0.1:19443** (UI) + 127.0.0.1:19392 — moved off 443/80/9392 because THIS workstation is a k3s worker whose ingress hostPorts claim those). Registry:
 registry.community.greenbone.net (Docker Hub greenbone/* is discontinued;
 ghcr.io/greenbone/gvmd exists but the official stack uses the community
 registry — use the official file as-is).