diff --git a/deploy/compose.yml b/deploy/compose.yml
index 701d09d..d59b037 100644
--- a/deploy/compose.yml
+++ b/deploy/compose.yml
@@ -43,6 +43,20 @@ services:
       retries: 3
       start_period: 5s
 
+# The project network gets an explicit, small subnet. The host's docker daemon
+# has every default address pool allocated by other projects ("all predefined
+# address pools have been fully subnetted"), so an implicit compose network
+# cannot be created. Pinning /28 of RFC1918 space that no other bridge or route
+# on .13 uses keeps this deploy independent of the host's pool exhaustion and
+# does not touch any other container. Single-service stack: two addresses is
+# plenty.
+networks:
+  default:
+    ipam:
+      config:
+        - subnet: 10.89.0.0/28
+          gateway: 10.89.0.1
+
 # Phase 4/5 add at most three more containers (Qdrant, Prefect worker, query
 # service) inside the 4-container and 1.0 GiB budget in AGENTS.md §4.3. Mode A
 # needs none of them and must keep working when they are stopped (test A1).