diff --git a/.tangled/workflows/admission.yml b/.tangled/workflows/admission.yml
index 491a3bf..2274121 100644
--- a/.tangled/workflows/admission.yml
+++ b/.tangled/workflows/admission.yml
@@ -28,7 +28,16 @@ dependencies:
   - e2fsprogs
 
 virtualisation:
-  docker: true
+  docker:
+    enable: true
+    # The guest ran out of docker networks mid-run ("all predefined address
+    # pools have been fully subnetted"), which then failed container setup for
+    # later steps. Give it an explicit, roomy pool: 256 /24s.
+    daemon:
+      settings:
+        default-address-pools:
+          - base: "10.201.0.0/16"
+            size: 24
 
 environment:
   STREAM_UPSTREAM_REPO: "/workspace/upstream-jetstream"
@@ -78,6 +87,9 @@ steps:
       set -euo pipefail
       export PATH=/workspace/.zig:$PATH
       printf '%s' "$ATCR_APP_PASSWORD" | docker login atcr.io -u zat.dev --password-stdin || true
+      # Suites create and drop containers/networks throughout; reclaim any
+      # leaked networks first so a long run cannot exhaust the pool.
+      docker network prune -f >/dev/null 2>&1 || true
       ./scripts/admit run
 
   - name: publish image (best effort)
diff --git a/justfile b/justfile
index be16ebb..a0dfee0 100644
--- a/justfile
+++ b/justfile
@@ -422,8 +422,12 @@ oracle:
 
 # One-time networked bootstrap for the pinned strict-storage tool image.
 # Actual power-loss runs never pull or install anything.
+#
+# No --platform: build for whatever the host is. Hardcoding linux/arm64 (fine
+# on an arm64 workstation) produced an arm64 image on x86_64 CI whose every
+# RUN died with "exec /bin/sh: exec format error".
 powerloss-image:
-    docker build --platform=linux/arm64 --pull=false \
+    docker build --pull=false \
       -t stream-powerloss-oracle:ubuntu24.04 tests -f tests/powerloss.Dockerfile
 
 # Real Linux binary + RocksDB + ext4 + kernel NBD. Expects `just simulator`;