diff --git a/docker/l4-port-manager/entrypoint.sh b/docker/l4-port-manager/entrypoint.sh
index d5989174..ed23b98d 100755
--- a/docker/l4-port-manager/entrypoint.sh
+++ b/docker/l4-port-manager/entrypoint.sh
@@ -93,7 +93,7 @@ do_apply() {
   write_status "applying" "Recreating caddy container with updated ports..."
 
   # shellcheck disable=SC2086
-  if docker compose $COMPOSE_ARGS up -d --no-deps --force-recreate caddy 2>&1; then
+  if docker compose $COMPOSE_ARGS up -d --no-deps --pull never --force-recreate caddy 2>&1; then
     log "Caddy container recreated successfully."
 
     # Wait for caddy healthcheck to pass
diff --git a/tests/unit/l4-port-manager-entrypoint.test.ts b/tests/unit/l4-port-manager-entrypoint.test.ts
index 076f54bf..196b1cc6 100644
--- a/tests/unit/l4-port-manager-entrypoint.test.ts
+++ b/tests/unit/l4-port-manager-entrypoint.test.ts
@@ -89,12 +89,12 @@ describe('L4 port manager entrypoint.sh', () => {
     expect(script).toContain('"$CURRENT_TRIGGER" = "$LAST_TRIGGER"');
   });
 
-  it('does not pull images (only recreates)', () => {
+  it('uses --pull never to avoid registry pulls (only recreates)', () => {
     const composeUpLines = lines.filter(line =>
       line.includes('docker compose') && line.includes('up')
     );
     for (const line of composeUpLines) {
-      expect(line).not.toContain('--pull');
+      expect(line).toContain('--pull never');
       expect(line).not.toContain('--build');
     }
   });