diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index 5355c05..adef4fc 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -26,7 +26,7 @@ jobs:
     - name: Fetch tags
       run: git fetch --tags --prune --unshallow
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
     - uses: shogo82148/actions-setup-redis@v1
@@ -36,14 +36,8 @@ jobs:
       run: |
         # sudo apt install redis
 
-        pushd ..
-        git clone https://github.com/bitnami/containers.git
-        cd containers/bitnami/openldap/2.6/debian-12
-        docker build -t bitnami/openldap:latest .
-        popd
-
         # Start LDAP
-        source continuous_integration/scripts/start_LDAP.sh
+        bash continuous_integration/scripts/start_LDAP.sh
 
         # These packages are installed in the base environment but may be older
         # versions. Explicitly upgrade them because they often create
@@ -70,6 +64,19 @@ jobs:
 
         pip list
     - name: Test with pytest
+      env:
+        PYTEST_ADDOPTS: "--durations=20"
       run: |
         coverage run -m pytest -vv
         coverage report -m
+    - name: Dump LDAP diagnostics on failure
+      if: failure()
+      run: |
+        docker ps
+        docker compose -f continuous_integration/docker-configs/ldap-docker-compose.yml ps
+        LDAP_CONTAINER_ID=$(docker compose -f continuous_integration/docker-configs/ldap-docker-compose.yml ps -q openldap | tr -d '[:space:]')
+        if [ -n "$LDAP_CONTAINER_ID" ]; then
+          docker logs --tail 200 "$LDAP_CONTAINER_ID"
+        else
+          docker compose -f continuous_integration/docker-configs/ldap-docker-compose.yml logs --tail 200 openldap
+        fi
diff --git a/bluesky_httpserver/tests/conftest.py b/bluesky_httpserver/tests/conftest.py
index d5cafdb..8a81df9 100644
--- a/bluesky_httpserver/tests/conftest.py
+++ b/bluesky_httpserver/tests/conftest.py
@@ -4,6 +4,7 @@
 import pytest
 import requests
 from bluesky_queueserver.manager.comms import zmq_single_request
+from bluesky_queueserver.manager.tests.common import re_manager_cmd  # noqa: F401
 from bluesky_queueserver.manager.tests.common import set_qserver_zmq_encoding  # noqa: F401
 from xprocess import ProcessStarter
 
@@ -60,7 +61,11 @@ def fastapi_server_fs(xprocess):
     to perform additional steps (such as setting environmental variables) before the server is started.
     """
 
-    def start(http_server_host=SERVER_ADDRESS, http_server_port=SERVER_PORT, api_key=API_KEY_FOR_TESTS):
+    def start(
+        http_server_host=SERVER_ADDRESS,
+        http_server_port=SERVER_PORT,
+        api_key=API_KEY_FOR_TESTS,
+    ):
         class Starter(ProcessStarter):
             max_read_lines = 53
 
@@ -112,7 +117,12 @@ def add_plans_to_queue():
 
     user_group = _user_group
     user = "HTTP unit test setup"
-    plan1 = {"name": "count", "args": [["det1", "det2"]], "kwargs": {"num": 10, "delay": 1}, "item_type": "plan"}
+    plan1 = {
+        "name": "count",
+        "args": [["det1", "det2"]],
+        "kwargs": {"num": 10, "delay": 1},
+        "item_type": "plan",
+    }
     plan2 = {"name": "count", "args": [["det1", "det2"]], "item_type": "plan"}
     for plan in (plan1, plan2, plan2):
         resp2, _ = zmq_single_request("queue_item_add", {"item": plan, "user": user, "user_group": user_group})
@@ -120,7 +130,14 @@ def add_plans_to_queue():
 
 
 def request_to_json(
-    request_type, path, *, request_prefix="/api", api_key=API_KEY_FOR_TESTS, token=None, login=None, **kwargs
+    request_type,
+    path,
+    *,
+    request_prefix="/api",
+    api_key=API_KEY_FOR_TESTS,
+    token=None,
+    login=None,
+    **kwargs,
 ):
     if login:
         auth = None
diff --git a/bluesky_httpserver/tests/test_authenticators.py b/bluesky_httpserver/tests/test_authenticators.py
index 53c6bbe..7b7dd4b 100644
--- a/bluesky_httpserver/tests/test_authenticators.py
+++ b/bluesky_httpserver/tests/test_authenticators.py
@@ -1,4 +1,5 @@
 import asyncio
+import os
 import time
 from typing import Any, Tuple
 
@@ -10,20 +11,28 @@
 from respx import MockRouter
 from starlette.datastructures import URL, QueryParams
 
-# fmt: off
 from ..authenticators import LDAPAuthenticator, OIDCAuthenticator, ProxiedOIDCAuthenticator, UserSessionState
 
+LDAP_TEST_HOST = os.environ.get("QSERVER_TEST_LDAP_HOST", "localhost")
+LDAP_TEST_PORT = int(os.environ.get("QSERVER_TEST_LDAP_PORT", "1389"))
+LDAP_TEST_ALT_HOST = os.environ.get("QSERVER_TEST_LDAP_ALT_HOST")
+if not LDAP_TEST_ALT_HOST:
+    LDAP_TEST_ALT_HOST = "127.0.0.1" if LDAP_TEST_HOST == "localhost" else LDAP_TEST_HOST
+
+
+# fmt: off
+
 
 @pytest.mark.parametrize("ldap_server_address, ldap_server_port", [
-    ("localhost", 1389),
-    ("localhost:1389", 904),  # Random port, ignored
-    ("localhost:1389", None),
-    ("127.0.0.1", 1389),
-    ("127.0.0.1:1389", 904),
-    (["localhost"], 1389),
-    (["localhost", "127.0.0.1"], 1389),
-    (["localhost", "127.0.0.1:1389"], 1389),
-    (["localhost:1389", "127.0.0.1:1389"], None),
+    (LDAP_TEST_HOST, LDAP_TEST_PORT),
+    (f"{LDAP_TEST_HOST}:{LDAP_TEST_PORT}", 904),  # Random port, ignored
+    (f"{LDAP_TEST_HOST}:{LDAP_TEST_PORT}", None),
+    (LDAP_TEST_ALT_HOST, LDAP_TEST_PORT),
+    (f"{LDAP_TEST_ALT_HOST}:{LDAP_TEST_PORT}", 904),
+    ([LDAP_TEST_HOST], LDAP_TEST_PORT),
+    ([LDAP_TEST_HOST, LDAP_TEST_ALT_HOST], LDAP_TEST_PORT),
+    ([LDAP_TEST_HOST, f"{LDAP_TEST_ALT_HOST}:{LDAP_TEST_PORT}"], LDAP_TEST_PORT),
+    ([f"{LDAP_TEST_HOST}:{LDAP_TEST_PORT}", f"{LDAP_TEST_ALT_HOST}:{LDAP_TEST_PORT}"], None),
 ])
 # fmt: on
 @pytest.mark.parametrize("use_tls,use_ssl", [(False, False)])
diff --git a/bluesky_httpserver/tests/test_console_output.py b/bluesky_httpserver/tests/test_console_output.py
index 1f089ec..6193db0 100644
--- a/bluesky_httpserver/tests/test_console_output.py
+++ b/bluesky_httpserver/tests/test_console_output.py
@@ -3,17 +3,16 @@
 import re
 import threading
 import time as ttime
+from typing import Any
 
 import pytest
 import requests
-from bluesky_queueserver.manager.tests.common import re_manager_cmd  # noqa F401
 from websockets.sync.client import connect
 
 from bluesky_httpserver.tests.conftest import (  # noqa F401
     API_KEY_FOR_TESTS,
     SERVER_ADDRESS,
     SERVER_PORT,
-    fastapi_server_fs,
     request_to_json,
     set_qserver_zmq_encoding,
     wait_for_environment_to_be_closed,
@@ -36,37 +35,42 @@ def __init__(self, api_key=API_KEY_FOR_TESTS, **kwargs):
         self._api_key = api_key
 
     def run(self):
-        kwargs = {"stream": True}
+        kwargs: dict[str, Any] = {"stream": True}
         if self._api_key:
-            auth = None
             headers = {"Authorization": f"ApiKey {self._api_key}"}
-            kwargs.update({"auth": auth, "headers": headers})
+            kwargs.update({"headers": headers})
+
+        kwargs["timeout"] = (5, 1)
 
-        with requests.get(f"http://{SERVER_ADDRESS}:{SERVER_PORT}/api/stream_console_output", **kwargs) as r:
-            r.encoding = "utf-8"
+        while not self._exit:
+            try:
+                with requests.get(
+                    f"http://{SERVER_ADDRESS}:{SERVER_PORT}/api/stream_console_output",
+                    **kwargs,
+                ) as r:
+                    r.encoding = "utf-8"
 
-            characters = []
-            n_brackets = 0
+                    characters = []
+                    n_brackets = 0
 
-            for ch in r.iter_content(decode_unicode=True):
-                # Note, that some output must be received from the server before the loop exits
-                if self._exit:
-                    break
+                    for ch in r.iter_content(decode_unicode=True):
+                        if self._exit:
+                            return
 
-                characters.append(ch)
-                if ch == "{":
-                    n_brackets += 1
-                elif ch == "}":
-                    n_brackets -= 1
+                        characters.append(ch)
+                        if ch == "{":
+                            n_brackets += 1
+                        elif ch == "}":
+                            n_brackets -= 1
 
-                # If the received buffer ('characters') is not empty and the message contains
-                #   equal number of opening and closing brackets then consider the message complete.
-                if characters and not n_brackets:
-                    line = "".join(characters)
-                    characters = []
+                        if characters and not n_brackets:
+                            line = "".join(characters)
+                            characters = []
 
-                    print(f"{line}")
-                    self.received_data_buffer.append(json.loads(line))
+                            print(f"{line}")
+                            self.received_data_buffer.append(json.loads(line))
+            except requests.exceptions.ReadTimeout:
+                continue
 
     def stop(self):
         """
@@ -81,7 +85,10 @@ def __del__(self):
 
 @pytest.mark.parametrize("zmq_port", (None, 60619))
 def test_http_server_stream_console_output_1(
-    monkeypatch, re_manager_cmd, fastapi_server_fs, zmq_port  # noqa F811
+    monkeypatch,
+    re_manager_cmd,
+    fastapi_server_fs,
+    zmq_port,  # noqa F811
 ):
     """
     Test for ``stream_console_output`` API
@@ -122,7 +129,8 @@ def test_http_server_stream_console_output_1(
     assert resp2["items"][0] == resp1["item"]
     assert resp2["running_item"] == {}
 
-    rsc.join()
+    rsc.join(timeout=10)
+    assert not rsc.is_alive(), "Timed out waiting for stream_console_output thread to terminate"
 
     assert len(rsc.received_data_buffer) >= 2, pprint.pformat(rsc.received_data_buffer)
 
@@ -160,7 +168,11 @@ def test_http_server_stream_console_output_1(
 @pytest.mark.parametrize("zmq_encoding", (None, "json", "msgpack"))
 @pytest.mark.parametrize("zmq_port", (None, 60619))
 def test_http_server_console_output_1(
-    monkeypatch, re_manager_cmd, fastapi_server_fs, zmq_port, zmq_encoding  # noqa F811
+    monkeypatch,
+    re_manager_cmd,
+    fastapi_server_fs,
+    zmq_port,
+    zmq_encoding,  # noqa F811
 ):
     """
     Test for ``console_output`` API (not a streaming version).
@@ -238,7 +250,10 @@ def test_http_server_console_output_1(
 
 @pytest.mark.parametrize("zmq_port", (None, 60619))
 def test_http_server_console_output_update_1(
-    monkeypatch, re_manager_cmd, fastapi_server_fs, zmq_port  # noqa F811
+    monkeypatch,
+    re_manager_cmd,
+    fastapi_server_fs,
+    zmq_port,  # noqa F811
 ):
     """
     Test for ``console_output`` API (not a streaming version).
@@ -379,7 +394,10 @@ def __del__(self):
 
 @pytest.mark.parametrize("zmq_port", (None, 60619))
 def test_http_server_console_output_socket_1(
-    monkeypatch, re_manager_cmd, fastapi_server_fs, zmq_port  # noqa F811
+    monkeypatch,
+    re_manager_cmd,
+    fastapi_server_fs,
+    zmq_port,  # noqa F811
 ):
     """
     Test for ``/console_output/ws`` websocket
@@ -421,7 +439,8 @@ def test_http_server_console_output_socket_1(
     assert resp2["items"][0] == resp1["item"]
     assert resp2["running_item"] == {}
 
-    rsc.join()
+    rsc.join(timeout=10)
+    assert not rsc.is_alive(), "Timed out waiting for console_output websocket thread to terminate"
 
     assert len(rsc.received_data_buffer) >= 2, pprint.pformat(rsc.received_data_buffer)
 
diff --git a/bluesky_httpserver/tests/test_core_api_main.py b/bluesky_httpserver/tests/test_core_api_main.py
index b2b5140..0c471bd 100644
--- a/bluesky_httpserver/tests/test_core_api_main.py
+++ b/bluesky_httpserver/tests/test_core_api_main.py
@@ -30,8 +30,17 @@
 
 # Plans used in most of the tests: '_plan1' and '_plan2' are quickly executed '_plan3' runs for 5 seconds.
 _plan1 = {"name": "count", "args": [["det1", "det2"]], "item_type": "plan"}
-_plan2 = {"name": "scan", "args": [["det1", "det2"], "motor", -1, 1, 10], "item_type": "plan"}
-_plan3 = {"name": "count", "args": [["det1", "det2"]], "kwargs": {"num": 5, "delay": 1}, "item_type": "plan"}
+_plan2 = {
+    "name": "scan",
+    "args": [["det1", "det2"], "motor", -1, 1, 10],
+    "item_type": "plan",
+}
+_plan3 = {
+    "name": "count",
+    "args": [["det1", "det2"]],
+    "kwargs": {"num": 5, "delay": 1},
+    "item_type": "plan",
+}
 _instruction_stop = {"name": "queue_stop", "item_type": "instruction"}
 
 
@@ -515,8 +524,10 @@ def test_http_server_queue_item_update_2_fail(re_manager, fastapi_server, replac
 
     resp2 = request_to_json("post", "/queue/item/update", json=params)
     assert resp2["success"] is False
-    assert resp2["msg"] == "Failed to add an item: Failed to replace item: " \
-                           "Item with UID 'incorrect_uid' is not in the queue"
+    assert (
+        resp2["msg"] == "Failed to add an item: Failed to replace item: "
+        "Item with UID 'incorrect_uid' is not in the queue"
+    )
 
     resp3 = request_to_json("get", "/queue/get")
     assert resp3["items"] != []
@@ -1286,16 +1297,33 @@ def test_http_server_history_clear(re_manager, fastapi_server, clear_params, exp
 
 
 def test_http_server_manager_kill(re_manager, fastapi_server):  # noqa F811
+    timeout_variants = (
+        "Request timeout: ZMQ communication error: timeout occurred",
+        "Request timeout: ZMQ communication error: Resource temporarily unavailable",
+    )
+
     request_to_json("post", "/environment/open")
     assert wait_for_environment_to_be_created(10), "Timeout"
 
     resp = request_to_json("post", "/test/manager/kill")
     assert "success" not in resp
-    assert "Request timeout: ZMQ communication error: timeout occurred" in resp["detail"]
-
-    ttime.sleep(10)
+    assert any(_ in resp["detail"] for _ in timeout_variants)
+
+    deadline = ttime.time() + 20
+    last_status = None
+    while ttime.time() < deadline:
+        ttime.sleep(0.2)
+        last_status = request_to_json("get", "/status")
+        if (
+            isinstance(last_status, dict)
+            and last_status.get("manager_state") == "idle"
+            and last_status.get("worker_environment_exists") is True
+        ):
+            break
+    else:
+        assert False, f"Timeout while waiting for manager recovery after kill. Last status: {last_status!r}"
 
-    resp = request_to_json("get", "/status")
+    resp = last_status
     assert resp["msg"].startswith("RE Manager")
     assert resp["manager_state"] == "idle"
     assert resp["items_in_queue"] == 0
diff --git a/bluesky_httpserver/tests/test_server.py b/bluesky_httpserver/tests/test_server.py
index 117f4df..33b82a2 100644
--- a/bluesky_httpserver/tests/test_server.py
+++ b/bluesky_httpserver/tests/test_server.py
@@ -27,8 +27,17 @@
 
 # Plans used in most of the tests: '_plan1' and '_plan2' are quickly executed '_plan3' runs for 5 seconds.
 _plan1 = {"name": "count", "args": [["det1", "det2"]], "item_type": "plan"}
-_plan2 = {"name": "scan", "args": [["det1", "det2"], "motor", -1, 1, 10], "item_type": "plan"}
-_plan3 = {"name": "count", "args": [["det1", "det2"]], "kwargs": {"num": 5, "delay": 1}, "item_type": "plan"}
+_plan2 = {
+    "name": "scan",
+    "args": [["det1", "det2"], "motor", -1, 1, 10],
+    "item_type": "plan",
+}
+_plan3 = {
+    "name": "count",
+    "args": [["det1", "det2"]],
+    "kwargs": {"num": 5, "delay": 1},
+    "item_type": "plan",
+}
 
 
 _config_public_key = """
@@ -122,7 +131,7 @@ def test_http_server_secure_1(monkeypatch, tmpdir, re_manager_cmd, fastapi_serve
 @pytest.mark.parametrize("option", ["ev", "cfg_file", "both"])
 # fmt: on
 def test_http_server_set_zmq_address_1(
-    monkeypatch, tmpdir, re_manager_cmd, fastapi_server_fs, option  # noqa: F811
+    monkeypatch, tmpdir, re_manager_cmd, fastapi_server_fs, free_tcp_port_factory, option  # noqa: F811
 ):
     """
     Test if ZMQ address of RE Manager is passed to the HTTP server using 'QSERVER_ZMQ_ADDRESS_CONTROL'
@@ -130,11 +139,12 @@ def test_http_server_set_zmq_address_1(
     channel different from default address, add and execute a plan.
     """
 
-    # Change ZMQ address to use port 60616 instead of the default port 60615.
-    zmq_control_address_server = "tcp://*:60616"
-    zmq_info_address_server = "tcp://*:60617"
-    zmq_control_address = "tcp://localhost:60616"
-    zmq_info_address = "tcp://localhost:60617"
+    zmq_control_port = free_tcp_port_factory()
+    zmq_info_port = free_tcp_port_factory()
+    zmq_control_address_server = f"tcp://*:{zmq_control_port}"
+    zmq_info_address_server = f"tcp://*:{zmq_info_port}"
+    zmq_control_address = f"tcp://localhost:{zmq_control_port}"
+    zmq_info_address = f"tcp://localhost:{zmq_info_port}"
     if option == "ev":
         monkeypatch.setenv("QSERVER_ZMQ_CONTROL_ADDRESS", zmq_control_address)
         monkeypatch.setenv("QSERVER_ZMQ_INFO_ADDRESS", zmq_info_address)
diff --git a/continuous_integration/docker-configs/ldap-docker-compose.yml b/continuous_integration/docker-configs/ldap-docker-compose.yml
index 2b2c45a..5fbfc53 100644
--- a/continuous_integration/docker-configs/ldap-docker-compose.yml
+++ b/continuous_integration/docker-configs/ldap-docker-compose.yml
@@ -1,14 +1,13 @@
 services:
   openldap:
-    image: osixia/openldap:latest
+    image: osixia/openldap:1.5.0
     ports:
-      - '1389:1389'
-      - '1636:1636'
+      - '1389:389'
+      - '1636:636'
     environment:
-      - LDAP_ADMIN_USERNAME=admin
+      - LDAP_ORGANISATION=Example Inc.
+      - LDAP_DOMAIN=example.org
       - LDAP_ADMIN_PASSWORD=adminpassword
-      - LDAP_USERS=user01,user02
-      - LDAP_PASSWORDS=password1,password2
     volumes:
       - 'openldap_data:/var/lib/ldap'
 
diff --git a/docker/test.Dockerfile b/continuous_integration/dockerfiles/test.Dockerfile
similarity index 100%
rename from docker/test.Dockerfile
rename to continuous_integration/dockerfiles/test.Dockerfile
diff --git a/continuous_integration/scripts/start_LDAP.sh b/continuous_integration/scripts/start_LDAP.sh
index ecfa1cf..d2bd48d 100755
--- a/continuous_integration/scripts/start_LDAP.sh
+++ b/continuous_integration/scripts/start_LDAP.sh
@@ -1,7 +1,195 @@
-#!/bin/bash
-set -e
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+COMPOSE_FILE="${LDAP_COMPOSE_FILE:-$ROOT_DIR/continuous_integration/docker-configs/ldap-docker-compose.yml}"
+COMPOSE_PROJECT="${LDAP_COMPOSE_PROJECT:-}"
+LDAP_HOST="${LDAP_HOST:-127.0.0.1}"
+LDAP_PORT="${LDAP_PORT:-1389}"
+LDAP_ADMIN_DN="cn=admin,dc=example,dc=org"
+LDAP_ADMIN_PASSWORD="adminpassword"
+LDAP_BASE_DN="dc=example,dc=org"
+
+compose_cmd() {
+    if [[ -n "$COMPOSE_PROJECT" ]]; then
+        docker compose -p "$COMPOSE_PROJECT" -f "$COMPOSE_FILE" "$@"
+    else
+        docker compose -f "$COMPOSE_FILE" "$@"
+    fi
+}
+
+get_openldap_container_id() {
+    compose_cmd ps -q openldap | tr -d '[:space:]'
+}
+
+wait_for_ldap() {
+    local timeout_seconds="${1:-60}"
+    local deadline=$((SECONDS + timeout_seconds))
+
+    while (( SECONDS < deadline )); do
+        if python - <<PY >/dev/null 2>&1
+import socket
+
+with socket.create_connection(("${LDAP_HOST}", ${LDAP_PORT}), timeout=1):
+    pass
+PY
+        then
+            return 0
+        fi
+        sleep 1
+    done
+
+    return 1
+}
+
+wait_for_ldap_bind() {
+    local container_id="$1"
+    local timeout_seconds="${2:-60}"
+    local deadline=$((SECONDS + timeout_seconds))
+    local rc=0
+
+    while (( SECONDS < deadline )); do
+        rc=0
+        docker exec "$container_id" ldapsearch \
+            -x \
+            -H "ldap://127.0.0.1:389" \
+            -D "$LDAP_ADMIN_DN" \
+            -w "$LDAP_ADMIN_PASSWORD" \
+            -b "$LDAP_BASE_DN" \
+            -s base \
+            "(objectclass=*)" dn >/dev/null 2>&1 || rc=$?
+        if [[ "$rc" -eq 0 ]]; then
+            return 0
+        fi
+        sleep 1
+    done
+
+    return 1
+}
+
+wait_for_ldap_test_user_bind() {
+    local container_id="$1"
+    local timeout_seconds="${2:-60}"
+    local deadline=$((SECONDS + timeout_seconds))
+    local rc=0
+
+    while (( SECONDS < deadline )); do
+        rc=0
+        docker exec "$container_id" ldapwhoami \
+            -x \
+            -H "ldap://127.0.0.1:389" \
+            -D "cn=user01,ou=users,$LDAP_BASE_DN" \
+            -w "password1" >/dev/null 2>&1 || rc=$?
+        if [[ "$rc" -eq 0 ]]; then
+            return 0
+        fi
+        sleep 1
+    done
+
+    return 1
+}
+
+print_ldap_diagnostics() {
+    local container_id="${1:-}"
+
+    echo "LDAP startup diagnostics:" >&2
+    compose_cmd ps >&2 || true
+
+    if [[ -z "$container_id" ]]; then
+        container_id="$(get_openldap_container_id)"
+    fi
+
+    if [[ -n "$container_id" ]]; then
+        docker logs --tail 200 "$container_id" >&2 || true
+    else
+        compose_cmd logs --tail 200 openldap >&2 || true
+    fi
+}
+
+ldap_entry_exists() {
+    local container_id="$1"
+    local dn="$2"
+
+    docker exec "$container_id" ldapsearch \
+        -x \
+        -H "ldap://127.0.0.1:389" \
+        -D "$LDAP_ADMIN_DN" \
+        -w "$LDAP_ADMIN_PASSWORD" \
+        -b "$dn" \
+        -s base \
+        "(objectclass=*)" dn >/dev/null 2>&1
+}
+
+ldap_add_if_missing() {
+    local container_id="$1"
+    local dn="$2"
+    local ldif="$3"
+
+    if ldap_entry_exists "$container_id" "$dn"; then
+        return 0
+    fi
+
+    docker exec -i "$container_id" ldapadd \
+        -x \
+        -H "ldap://127.0.0.1:389" \
+        -D "$LDAP_ADMIN_DN" \
+        -w "$LDAP_ADMIN_PASSWORD" >/dev/null <<EOF
+${ldif}
+EOF
+}
+
+seed_ldap_test_users() {
+    local container_id="$1"
+
+    ldap_add_if_missing "$container_id" "ou=users,$LDAP_BASE_DN" "dn: ou=users,$LDAP_BASE_DN
+objectClass: organizationalUnit
+ou: users"
+
+    ldap_add_if_missing "$container_id" "cn=user01,ou=users,$LDAP_BASE_DN" "dn: cn=user01,ou=users,$LDAP_BASE_DN
+objectClass: inetOrgPerson
+cn: user01
+sn: user01
+uid: user01
+userPassword: password1"
+
+    ldap_add_if_missing "$container_id" "cn=user02,ou=users,$LDAP_BASE_DN" "dn: cn=user02,ou=users,$LDAP_BASE_DN
+objectClass: inetOrgPerson
+cn: user02
+sn: user02
+uid: user02
+userPassword: password2"
+}
 
 # Start LDAP server in docker container
-docker pull osixia/openldap:latest
-docker compose -f continuous_integration/docker-configs/ldap-docker-compose.yml up -d
+compose_cmd up -d
+CONTAINER_ID="$(get_openldap_container_id)"
+if [[ -z "$CONTAINER_ID" ]]; then
+    echo "Unable to determine LDAP container id from compose project." >&2
+    print_ldap_diagnostics
+    exit 1
+fi
+
+if ! wait_for_ldap 120; then
+    echo "LDAP port ${LDAP_HOST}:${LDAP_PORT} did not become reachable in time." >&2
+    print_ldap_diagnostics "$CONTAINER_ID"
+    exit 1
+fi
+
+echo "LDAP port ${LDAP_HOST}:${LDAP_PORT} is reachable. Waiting for slapd initialization..."
+sleep 3
+
+if ! wait_for_ldap_bind "$CONTAINER_ID" 120; then
+    echo "LDAP admin bind did not become ready in time." >&2
+    print_ldap_diagnostics "$CONTAINER_ID"
+    exit 1
+fi
+
+seed_ldap_test_users "$CONTAINER_ID"
+
+if ! wait_for_ldap_test_user_bind "$CONTAINER_ID" 60; then
+    echo "LDAP test-user bind did not become ready in time." >&2
+    print_ldap_diagnostics "$CONTAINER_ID"
+    exit 1
+fi
+
 docker ps
diff --git a/docs/source/usage.rst b/docs/source/usage.rst
index 299bdcb..bcae133 100644
--- a/docs/source/usage.rst
+++ b/docs/source/usage.rst
@@ -169,7 +169,7 @@ If you are already in a browser context, open:
 
 This redirects to the OIDC provider login page and then back to the server callback.
 
-This can similarly be acheived using ``httpie`` by opening the URL in a browser after getting 
+This can similarly be acheived using ``httpie`` by opening the URL in a browser after getting
 the authorization URI from the server::
 
   http POST http://localhost:60610/api/auth/provider/entra/authorize
@@ -183,7 +183,7 @@ spawn a browser for the user to log in to the provider.
 CLI/device flow
 ***************
 
-For terminal clients (i.e. no browser possible), start with 
+For terminal clients (i.e. no browser possible), start with
 ``POST /api/auth/provider/<provider-name>/authorize``.
 The response includes:
 
diff --git a/scripts/run_ci_docker_parallel.sh b/scripts/run_ci_docker_parallel.sh
index c9caee7..efb6594 100755
--- a/scripts/run_ci_docker_parallel.sh
+++ b/scripts/run_ci_docker_parallel.sh
@@ -8,8 +8,10 @@ CHUNK_COUNT=""
 PYTHON_VERSIONS="latest"
 PYTEST_EXTRA_ARGS=""
 ARTIFACTS_DIR="$ROOT_DIR/.docker-test-artifacts"
-DOCKER_NETWORK_NAME="bhs-ci-net"
-LDAP_CONTAINER_NAME="bhs-ci-ldap"
+LDAP_COMPOSE_FILE="$ROOT_DIR/continuous_integration/docker-configs/ldap-docker-compose.yml"
+LDAP_COMPOSE_PROJECT="bhs-ci-ldap-parallel-$$"
+LDAP_SERVICE_NAME="openldap"
+DOCKER_NETWORK_NAME="${LDAP_COMPOSE_PROJECT}_default"
 
 SUMMARY_TSV=""
 SUMMARY_FAIL_LOGS=""
@@ -154,46 +156,16 @@ normalize_python_versions() {
     echo "${normalized[@]}"
 }
 
-ensure_ldap_image() {
-    local image_ref="bitnami/openldap:latest"
-    if docker image inspect "$image_ref" >/dev/null 2>&1; then
-        return
-    fi
-
-    echo "LDAP image $image_ref not found locally; trying docker pull..."
-    if docker pull "$image_ref"; then
-        return
-    fi
-
-    echo "docker pull failed; building bitnami/openldap:latest from source (CI fallback)."
-    local workdir="$ROOT_DIR/.docker-test-artifacts/bitnami-containers"
-    rm -rf "$workdir"
-    git clone --depth 1 https://github.com/bitnami/containers.git "$workdir"
-    (cd "$workdir/bitnami/openldap/2.6/debian-12" && docker build -t "$image_ref" .)
-}
-
 start_services() {
-    ensure_ldap_image
-
-    docker network rm "$DOCKER_NETWORK_NAME" >/dev/null 2>&1 || true
-    docker network create "$DOCKER_NETWORK_NAME" >/dev/null
-
-    docker rm -f "$LDAP_CONTAINER_NAME" >/dev/null 2>&1 || true
-    docker run -d --rm \
-        --name "$LDAP_CONTAINER_NAME" \
-        --network "$DOCKER_NETWORK_NAME" \
-        -e LDAP_ADMIN_USERNAME=admin \
-        -e LDAP_ADMIN_PASSWORD=adminpassword \
-        -e LDAP_USERS=user01,user02 \
-        -e LDAP_PASSWORDS=password1,password2 \
-        bitnami/openldap:latest >/dev/null
-
-    sleep 2
+    LDAP_COMPOSE_FILE="$LDAP_COMPOSE_FILE" \
+    LDAP_COMPOSE_PROJECT="$LDAP_COMPOSE_PROJECT" \
+    LDAP_HOST="127.0.0.1" \
+    LDAP_PORT="1389" \
+    bash "$ROOT_DIR/continuous_integration/scripts/start_LDAP.sh" >/dev/null
 }
 
 stop_services() {
-    docker rm -f "$LDAP_CONTAINER_NAME" >/dev/null 2>&1 || true
-    docker network rm "$DOCKER_NETWORK_NAME" >/dev/null 2>&1 || true
+    docker compose -p "$LDAP_COMPOSE_PROJECT" -f "$LDAP_COMPOSE_FILE" down -v >/dev/null 2>&1 || true
 }
 
 cleanup() {
@@ -385,8 +357,8 @@ run_chunk() {
         -e SHARD_COUNT="$CHUNK_COUNT" \
         -e ARTIFACTS_DIR="/artifacts" \
         -e PYTEST_EXTRA_ARGS="$PYTEST_EXTRA_ARGS" \
-        -e QSERVER_TEST_LDAP_HOST="$LDAP_CONTAINER_NAME" \
-        -e QSERVER_TEST_LDAP_PORT="1389" \
+        -e QSERVER_TEST_LDAP_HOST="$LDAP_SERVICE_NAME" \
+        -e QSERVER_TEST_LDAP_PORT="389" \
         -e QSERVER_TEST_REDIS_ADDR="localhost" \
         -e QSERVER_HTTP_TEST_BIND_HOST="127.0.0.1" \
         -e QSERVER_HTTP_TEST_HOST="127.0.0.1" \
@@ -400,7 +372,7 @@ run_chunk() {
 }
 
 export -f run_chunk
-export CHUNK_COUNT PYTEST_EXTRA_ARGS DOCKER_NETWORK_NAME LDAP_CONTAINER_NAME
+export CHUNK_COUNT PYTEST_EXTRA_ARGS DOCKER_NETWORK_NAME LDAP_SERVICE_NAME
 
 for PYTHON_VERSION in "${SELECTED_PYTHON_VERSIONS[@]}"; do
     CURRENT_IMAGE_TAG="${IMAGE_TAG_BASE}-py${PYTHON_VERSION}"
@@ -410,7 +382,7 @@ for PYTHON_VERSION in "${SELECTED_PYTHON_VERSIONS[@]}"; do
     echo "==> Building test image: $CURRENT_IMAGE_TAG (Python $PYTHON_VERSION)"
     docker build \
         --build-arg PYTHON_VERSION="$PYTHON_VERSION" \
-        -f "$ROOT_DIR/docker/test.Dockerfile" \
+        -f "$ROOT_DIR/continuous_integration/dockerfiles/test.Dockerfile" \
         -t "$CURRENT_IMAGE_TAG" \
         "$ROOT_DIR"