diff --git a/.gitignore b/.gitignore
index 09d93344..2cc5311f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@ wheels/
 
 # Environment (no subir: cada quien puede usar puertos distintos vía .env)
 .env
+.env.e2e.generated
 .env.local
 backend/.env
 frontend/.env
diff --git a/Jenkinsfile b/Jenkinsfile
index da255c3b..27852621 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -192,27 +192,48 @@ pipeline {
           export E2E_COMPOSE_PROJECT="anexo76-e2e-${BUILD_NUMBER}"
           export COMPOSE_PROJECT_NAME="${E2E_COMPOSE_PROJECT}"
           cd "$WORKSPACE"
+          : "${BUILD_NUMBER:=0}"
+          E2E_ENV_FILE="${WORKSPACE}/.env.e2e.generated"
+          # Puertos (dash/sh en Jenkins, sin depender de $RANDOM): rango ~20000–60k
+          T=$(date +%s 2>/dev/null || echo 0)
+          r1=$((T % 20000))
+          r2=$((T % 15000))
+          KC_HTTP=$(( 20000 + r1 + BUILD_NUMBER % 2000 ))
+          KC_MGMT=$(( 40000 + r2 + (BUILD_NUMBER * 7) % 2000 ))
+          if [ "$KC_HTTP" -gt 64000 ] || [ "$KC_HTTP" -lt 20000 ]; then KC_HTTP=$(( 22000 + BUILD_NUMBER % 8000 )); fi
+          if [ "$KC_MGMT" -gt 65000 ] || [ "$KC_MGMT" -lt 30000 ]; then KC_MGMT=$(( 50000 + BUILD_NUMBER % 8000 )); fi
+          if [ "$KC_HTTP" -eq "$KC_MGMT" ]; then KC_MGMT=$((KC_MGMT + 1)); fi
+          { echo "KEYCLOAK_HTTP_PORT=$KC_HTTP"; echo "KEYCLOAK_MANAGEMENT_PORT=$KC_MGMT"; echo "VITE_KEYCLOAK_URL=http://127.0.0.1:$KC_HTTP/kcauth"; } > "$E2E_ENV_FILE"
+          set -a
+          . "$E2E_ENV_FILE"
+          set +a
+          echo "E2E: Keycloak (host) en puertos de .env e2e:" && cat "$E2E_ENV_FILE"
+
+          e2e_compose() {
+            docker compose --env-file "$E2E_ENV_FILE" -f "$WORKSPACE/docker-compose.yml" "$@"
+          }
 
           compose_down() {
             export COMPOSE_PROJECT_NAME="${E2E_COMPOSE_PROJECT}"
-            docker compose -f "$WORKSPACE/docker-compose.yml" down --remove-orphans 2>/dev/null || true
+            e2e_compose down --remove-orphans 2>/dev/null || true
           }
           trap compose_down EXIT
           compose_down
           e2e_compose_fail_logs() {
-            echo "== E2E: fallo al levantar stack; diagnóstico (revisa postgres-keycloak antes que keycloak) =="
+            echo "== E2E: fallo al levantar stack; diagnóstico =="
+            echo "--- .env.e2e.generated ---"
+            cat "$E2E_ENV_FILE" 2>&1 || true
             export COMPOSE_PROJECT_NAME="${E2E_COMPOSE_PROJECT}"
             echo "--- docker compose ps -a ---"
-            docker compose -f "$WORKSPACE/docker-compose.yml" ps -a 2>&1 || true
+            e2e_compose ps -a 2>&1 || true
             echo "--- logs: anexo76-postgres-a76 (Postgres app) ---"
             docker logs --tail 250 anexo76-postgres-a76 2>&1 || true
-            echo "--- logs: anexo76-postgres-keycloak (Postgres de Keycloak; el healthcheck que suele fallar) ---"
+            echo "--- logs: anexo76-postgres-keycloak (Postgres de Keycloak) ---"
             docker logs --tail 400 anexo76-postgres-keycloak 2>&1 || true
-            echo "--- logs: anexo76-keycloak (servidor Keycloak; a veces no alcanzó a crearse) ---"
+            echo "--- logs: anexo76-keycloak (Keycloak) ---"
             docker logs --tail 250 anexo76-keycloak 2>&1 || true
           }
-          # Stack completo (API, Keycloak, Vite) — puede tardar varios minutos la 1.ª vez
-          if ! docker compose -f "$WORKSPACE/docker-compose.yml" up -d --build; then
+          if ! e2e_compose up -d --build; then
             e2e_compose_fail_logs
             exit 1
           fi
diff --git a/docker-compose.yml b/docker-compose.yml
index 33cef99f..065d2eb1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -107,9 +107,10 @@ services:
       - --http-enabled=true
       - --hostname-strict=false
       - --proxy-headers=xforwarded
+    # Host: KEYCLOAK_HTTP_PORT / KEYCLOAK_MANAGEMENT_PORT (CI, Jenkins) para no chocar con 8080/9000
     ports:
-      - "8080:8080"
-      - "9000:9000"
+      - "${KEYCLOAK_HTTP_PORT:-8080}:8080"
+      - "${KEYCLOAK_MANAGEMENT_PORT:-9000}:9000"
     depends_on:
       postgres-keycloak:
         condition: service_healthy
@@ -240,7 +241,7 @@ services:
       - NODE_ENV=${NODE_ENV:-development}
       - VITE_API_URL=${VITE_API_URL:-http://localhost:8000/api/}
       - INTERNAL_API_URL=${INTERNAL_API_URL:-http://backend:8000/api/}
-      - VITE_KEYCLOAK_URL=${VITE_KEYCLOAK_URL:-http://localhost:8080/kcauth}
+      - VITE_KEYCLOAK_URL=${VITE_KEYCLOAK_URL:-http://localhost:${KEYCLOAK_HTTP_PORT:-8080}/kcauth}
       - VITE_KEYCLOAK_REALM=${VITE_KEYCLOAK_REALM:-master}
       - VITE_KEYCLOAK_CLIENT_ID=${VITE_KEYCLOAK_CLIENT_ID:-anexo76-frontend}
       - KEYCLOAK_URL=${KEYCLOAK_URL:-http://keycloak:8080/kcauth}