diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index fb09b5647..3d1b344f4 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -306,6 +306,19 @@ jobs:
 
           GATEKEEPER_ORIGIN="${NEXT_PUBLIC_BASE_URL}/gatekeeper"
 
+          if [[ "$TARGET" == "production" ]]; then
+            INTERNAL_SUBNET="172.28.10.0/24"
+          elif [[ "$TARGET" == "testing" ]]; then
+            INTERNAL_SUBNET="172.28.11.0/24"
+          elif [[ "$TARGET" == "staging" ]]; then
+            INTERNAL_SUBNET="172.28.12.0/24"
+          else
+            HEX_SHA="${{ needs.prepare.outputs.short_sha }}"
+            DEC_SHA=$((16#$HEX_SHA))
+            SUBNET_NUM=$(( 13 + (DEC_SHA % 230) ))
+            INTERNAL_SUBNET="172.28.${SUBNET_NUM}.0/24"
+          fi
+
           {
             echo "# Generated by CI - $TARGET"
             echo "IMAGE_TAG=$IMAGE_TAG"
@@ -342,6 +355,7 @@ jobs:
             echo "COMPOSE_PROFILES=$COMPOSE_PROFILES"
             echo "AUTH_MIDDLEWARE=$AUTH_MIDDLEWARE"
             echo "AUTH_MIDDLEWARE_UNPROTECTED=$AUTH_MIDDLEWARE_UNPROTECTED"
+            echo "INTERNAL_SUBNET=$INTERNAL_SUBNET"
           } > .env.deploy
 
       - name: 🚀 SSH Deploy
diff --git a/docker-compose.yml b/docker-compose.yml
index f74b8802d..5942c09f6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -110,6 +110,9 @@ services:
 networks:
   default:
     name: ${PROJECT_NAME:-e-tib}-internal
+    ipam:
+      config:
+        - subnet: ${INTERNAL_SUBNET:-172.28.9.0/24}
   infra:
     external: true