diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e7cfcbf..8d4fce5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -7,6 +7,7 @@ variables:
   DOCKERFILE_PATH: Dockerfile.production
   # Required: disable TLS so the docker client can reach the dind daemon
   DOCKER_TLS_CERTDIR: ""
+  DOCKER_HOST: tcp://docker:2375
 
 # ====================================
 # TEST STAGE
@@ -23,7 +24,7 @@ unit_tests:
     - npm run test:api
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH == "develop"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 
 integration_tests:
   stage: test
@@ -61,7 +62,7 @@ integration_tests:
     - npm run test:api:integration
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH == "develop"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 
 # ====================================
 # BUILD STAGE
@@ -72,7 +73,11 @@ build_image:
   services:
     - name: docker:24-dind
       alias: docker
+      command: ["--tls=false"]
+      variables:
+        HEALTHCHECK_TCP_PORT: "2375"
   before_script:
+    - until docker info >/dev/null 2>&1; do echo "Waiting for Docker daemon..."; sleep 1; done
     # Prefer GitLab's built-in registry variables, but allow explicit fallbacks
     # so the pipeline can publish to any OCI-compatible registry.
     - export REGISTRY_HOST="${CI_REGISTRY:-${REGISTRY_HOST:-}}"
@@ -104,7 +109,7 @@ build_image:
   rules:
     # Skip the container publish step unless either the GitLab registry or an
     # explicit fallback registry configuration is available.
-    - if: '$CI_COMMIT_BRANCH == "develop" && (($CI_REGISTRY && $CI_REGISTRY_USER && $CI_REGISTRY_PASSWORD && $CI_REGISTRY_IMAGE) || ($REGISTRY_HOST && $REGISTRY_USER && $REGISTRY_PASSWORD && $REGISTRY_IMAGE))'
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && (($CI_REGISTRY && $CI_REGISTRY_USER && $CI_REGISTRY_PASSWORD && $CI_REGISTRY_IMAGE) || ($REGISTRY_HOST && $REGISTRY_USER && $REGISTRY_PASSWORD && $REGISTRY_IMAGE))'
     - when: never
 
 # ====================================
@@ -165,5 +170,5 @@ deploy_to_vps:
       "
   rules:
     # Deploy only when both registry access and VPS credentials are available.
-    - if: '$CI_COMMIT_BRANCH == "develop" && ((($CI_REGISTRY && $CI_REGISTRY_USER && $CI_REGISTRY_PASSWORD && $CI_REGISTRY_IMAGE) || ($REGISTRY_HOST && $REGISTRY_USER && $REGISTRY_PASSWORD && $REGISTRY_IMAGE)) && $SSH_PRIVATE_KEY && $VPS_IP && $VPS_USER)'
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && ((($CI_REGISTRY && $CI_REGISTRY_USER && $CI_REGISTRY_PASSWORD && $CI_REGISTRY_IMAGE) || ($REGISTRY_HOST && $REGISTRY_USER && $REGISTRY_PASSWORD && $REGISTRY_IMAGE)) && $SSH_PRIVATE_KEY && $VPS_IP && $VPS_USER)'
     - when: never
diff --git a/DOCKER.md b/DOCKER.md
index 7355ac7..c62eb11 100644
--- a/DOCKER.md
+++ b/DOCKER.md
@@ -179,6 +179,10 @@ REGISTRY_PASSWORD=<personal-access-token-or-deploy-token>
 
 The production compose file now reads `APP_IMAGE` and `APP_VERSION` for pull-based deploys. The GitLab deploy job injects those values automatically. If you want to pull manually on the server, you can also set `APP_IMAGE` in `.env.docker.production`.
 
+The CI pipeline publishes and deploys from the GitLab default branch (`$CI_DEFAULT_BRANCH`). If you change your release branch, update the repository default branch in GitLab instead of hard-coding branch names in `.gitlab-ci.yml`.
+
+If you use `docker:dind` on a self-hosted GitLab runner, the runner's Docker executor must be started with `privileged = true`. Without that, `docker:dind` often logs AppArmor or `/sys/kernel/security` mount errors and can become unreliable even when the job container still starts.
+
 #### 5. Start Traefik
 
 Traefik must be running before the app stack so it can wire up routes at startup.
diff --git a/Dockerfile.dev b/Dockerfile.dev
index 287ad82..adc0162 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -3,6 +3,7 @@ FROM node:20-bookworm
 WORKDIR /app
 
 RUN npm install -g npm@10.5.0 --no-fund --no-audit
+RUN corepack enable
 
 COPY package.json package-lock.json turbo.json tsconfig.base.json ./
 COPY apps ./apps
diff --git a/apps/admin/package.json b/apps/admin/package.json
index c330650..6817a57 100644
--- a/apps/admin/package.json
+++ b/apps/admin/package.json
@@ -4,12 +4,12 @@
   "private": true,
   "scripts": {
     "predev": "npm run build --workspace @rentaldrivego/types",
-    "dev": "next dev -p 3002",
+    "dev": "next dev -H 0.0.0.0 -p 3002",
     "prebuild": "npm run build --workspace @rentaldrivego/types",
     "build": "next build",
     "prestart": "npm run build --workspace @rentaldrivego/types",
     "pretype-check": "npm run build --workspace @rentaldrivego/types",
-    "start": "next start -p 3002",
+    "start": "next start -H 0.0.0.0 -p 3002",
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index 6506e16..443950b 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -198,9 +198,11 @@ cron.schedule('0 8 * * *', async () => {
 })
 
 // ─── Start ────────────────────────────────────────────────────
-const PORT = process.env.API_PORT ?? 4000
-server.listen(PORT, () => {
-  console.log(`[API] Server running on port ${PORT}`)
+const PORT = Number(process.env.API_PORT ?? 4000)
+const HOST = process.env.API_HOST ?? '0.0.0.0'
+
+server.listen(PORT, HOST, () => {
+  console.log(`[API] Server running on ${HOST}:${PORT}`)
 })
 
 export { app, io }
diff --git a/apps/dashboard/package.json b/apps/dashboard/package.json
index ba09626..d338b90 100644
--- a/apps/dashboard/package.json
+++ b/apps/dashboard/package.json
@@ -4,12 +4,12 @@
   "private": true,
   "scripts": {
     "predev": "npm run build --workspace @rentaldrivego/types",
-    "dev": "next dev -p 3001",
+    "dev": "next dev -H 0.0.0.0 -p 3001",
     "prebuild": "npm run build --workspace @rentaldrivego/types",
     "build": "next build",
     "prestart": "npm run build --workspace @rentaldrivego/types",
     "pretype-check": "npm run build --workspace @rentaldrivego/types",
-    "start": "next start -p 3001",
+    "start": "next start -H 0.0.0.0 -p 3001",
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
diff --git a/apps/marketplace/package.json b/apps/marketplace/package.json
index 600da12..314e8f9 100644
--- a/apps/marketplace/package.json
+++ b/apps/marketplace/package.json
@@ -4,12 +4,12 @@
   "private": true,
   "scripts": {
     "predev": "npm run build --workspace @rentaldrivego/types",
-    "dev": "next dev -p 3000",
+    "dev": "next dev -H 0.0.0.0 -p 3000",
     "prebuild": "npm run build --workspace @rentaldrivego/types",
     "build": "next build",
     "prestart": "npm run build --workspace @rentaldrivego/types",
     "pretype-check": "npm run build --workspace @rentaldrivego/types",
-    "start": "next start -p 3000",
+    "start": "next start -H 0.0.0.0 -p 3000",
     "type-check": "tsc --noEmit"
   },
   "dependencies": {