diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 38103a9..38e771d 100644
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -40,8 +40,14 @@ if ! docker exec "$candidate" wget -q -O /dev/null "http://host.docker.internal:
   rollback
   exit 1
 fi
-# Browser tests run on this runner against the actual deployed public URL.
-if ! docker run --rm --network host --ipc=host -e BASE_URL "adcloud-advertiser:$SOURCE_REVISION-tests"; then
+# Check public ingress from the CI container before opening the browser.
+if ! curl --fail --silent --show-error --connect-timeout 10 --max-time 20 "${BASE_URL%/}/healthz"; then
+  echo 'Public frontend ingress is unreachable; check TCP 18081 security group / reverse proxy.'
+  rollback
+  exit 1
+fi
+# Use the runner's normal bridge network, like the successful public API probe.
+if ! docker run --rm --shm-size=256m -e BASE_URL "adcloud-advertiser:$SOURCE_REVISION-tests"; then
   echo 'Deployed browser checks failed; restoring previous frontend'
   rollback
   exit 1