diff --git a/apps/semaphore.yaml b/apps/semaphore.yaml
index f750f94..a0a2e57 100644
--- a/apps/semaphore.yaml
+++ b/apps/semaphore.yaml
@@ -116,6 +116,8 @@ spec:
             secretKeyRef:
               name: semaphore-bootstrap
               key: access-key-encryption
+        - name: SEMAPHORE_PORT
+          value: :3000
         volumeMounts:
         - name: config
           mountPath: /etc/semaphore
diff --git a/catalog/semaphore.yaml b/catalog/semaphore.yaml
index eb78054..736f79e 100644
--- a/catalog/semaphore.yaml
+++ b/catalog/semaphore.yaml
@@ -66,6 +66,13 @@ env:
       secretKeyRef:
         name: semaphore-bootstrap
         key: access-key-encryption
+  # Because the Service is named `semaphore`, the kubelet injects a Docker-link-style
+  # SEMAPHORE_PORT=tcp://<svcIP>:3000 env var, which COLLIDES with Semaphore's OWN SEMAPHORE_PORT
+  # (its HTTP listen port) and crashes config validation ("field 'Port' is not valid: tcp://..."). An
+  # explicit env entry shadows the injected one (the kubelet gives user-defined env precedence over
+  # service links), pinning the listen port back to :3000 (matches containerPort/Service).
+  - name: SEMAPHORE_PORT
+    value: ":3000"
 # The semaphoreui/semaphore image runs as the non-root user UID 1001 / GID 0 (tini -> server-wrapper),
 # and on boot the wrapper writes its generated config.json into the config dir. A mounted Longhorn PVC
 # is root:root, so UID 1001 cannot write it -> the pod panics ("permission denied"). fsGroup=1001 makes