diff --git a/dev/test_recovery.py b/dev/test_recovery.py
index fa6794e..9a529f7 100644
--- a/dev/test_recovery.py
+++ b/dev/test_recovery.py
@@ -82,6 +82,19 @@ class RecoveryScriptTests(unittest.TestCase):
         for profile in ("fast", "medium", "large", "ultra", "uncensored"):
             self.assertIn(f"llama-{profile}", installer)
 
+    def test_gateway_consumers_are_stopped_before_gateway_recreation(self) -> None:
+        manager = (ROOT / "manage.sh").read_text(encoding="utf-8")
+        stop = 'stop llama-dashboard portainer'
+        deploy = 'up -d --build'
+        self.assertIn(stop, manager)
+        self.assertLess(manager.index(stop), manager.index(deploy))
+
+    def test_gateway_owns_shared_ui_ports_and_portainer_backup(self) -> None:
+        compose = (ROOT / "compose.yaml").read_text(encoding="utf-8")
+        self.assertIn('"8099:8099"', compose)
+        self.assertIn('"9443:9443"', compose)
+        self.assertIn('portainer-data:/backup/volumes/portainer-data:ro', compose)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/install.sh b/install.sh
index 1f8e47d..b1e8269 100755
--- a/install.sh
+++ b/install.sh
@@ -490,10 +490,9 @@ build_and_start() {
   docker compose --env-file "$SECRETS_DIR/stack.env" --profile inference create \
     llama-fast llama-medium llama-large llama-ultra llama-uncensored
   docker compose --env-file "$SECRETS_DIR/stack.env" --profile image create image-worker
+  docker compose --env-file "$SECRETS_DIR/stack.env" stop llama-dashboard portainer
   docker compose --env-file "$SECRETS_DIR/stack.env" up -d --build \
     wireguard-gateway xtts piper tts-gateway profile-controller router llama-dashboard portainer backup
-  docker compose --env-file "$SECRETS_DIR/stack.env" up -d \
-    --no-deps --force-recreate llama-dashboard portainer
   if [[ ${WIREGUARD_MODE:-container} == container ]]; then
     systemctl restart mike-ai-container-vpn-guard.service
   fi
diff --git a/manage.sh b/manage.sh
index 7a1ea39..265773e 100755
--- a/manage.sh
+++ b/manage.sh
@@ -48,19 +48,24 @@ case "$command" in
       shift
       [[ $# -eq 0 ]] || { echo "core akzeptiert keine weiteren Services" >&2; exit 2; }
       run "$ROOT_DIR/platform/mcp/install-tools.sh"
+      # Release the old gateway namespace (and its fixed network addresses)
+      # before replacing its owner. Otherwise Docker can strand the host with
+      # the old namespace still held by these two consumers.
+      run "${compose[@]}" stop llama-dashboard portainer
       run "${compose[@]}" up -d --build \
         wireguard-gateway piper xtts tts-gateway profile-controller router llama-dashboard portainer backup
-      # network_mode: service:wireguard-gateway stores the gateway container
-      # ID. Rebind namespace consumers after every gateway replacement.
-      run "${compose[@]}" up -d --no-deps --force-recreate llama-dashboard portainer
     else
-      run "${compose[@]}" up -d --build --no-deps "$@"
+      rebind_gateway=false
       for service in "$@"; do
-        if [[ $service == wireguard-gateway ]]; then
-          run "${compose[@]}" up -d --no-deps --force-recreate llama-dashboard portainer
-          break
-        fi
+        [[ $service == wireguard-gateway ]] && rebind_gateway=true
       done
+      if [[ $rebind_gateway == true ]]; then
+        run "${compose[@]}" stop llama-dashboard portainer
+      fi
+      run "${compose[@]}" up -d --build --no-deps "$@"
+      if [[ $rebind_gateway == true ]]; then
+        run "${compose[@]}" up -d --no-deps --force-recreate llama-dashboard portainer
+      fi
     fi
     ;;
   purge-legacy)