diff --git a/containers/searxng/searxng.config b/containers/searxng/searxng.config
index ed4d6fd..7328ec8 100755
--- a/containers/searxng/searxng.config
+++ b/containers/searxng/searxng.config
@@ -67,4 +67,4 @@ CFG_SEARXNG_NETWORK=default
 #   - webui: if true, this port serves the main web interface
 #   - description: human-readable description of the service
 #
-CFG_SEARXNG_PORT_1="searxng-service|webui|8083:8080|public|tcp|false|true|true|Search Interface||search"
+CFG_SEARXNG_PORT_1="searxng-service|webui|random:8080|public|tcp|false|true|true|Search Interface||search"
diff --git a/containers/vaultwarden/vaultwarden.config b/containers/vaultwarden/vaultwarden.config
index 03d9d02..e88c091 100755
--- a/containers/vaultwarden/vaultwarden.config
+++ b/containers/vaultwarden/vaultwarden.config
@@ -71,5 +71,5 @@ CFG_VAULTWARDEN_NETWORK=default
 #   - webui: if true, this port serves the main web interface
 #   - description: human-readable description of the service
 #
-CFG_VAULTWARDEN_PORT_1="vaultwarden-service|webui|8201:80|public|tcp|false|true|true|Password Manager Interface||vault"
+CFG_VAULTWARDEN_PORT_1="vaultwarden-service|webui|random:80|public|tcp|false|true|true|Password Manager Interface||vault"
 CFG_VAULTWARDEN_PORT_2="vaultwarden-exporter|metrics|3001:3001|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|"
diff --git a/scripts/instance/instance_create.sh b/scripts/instance/instance_create.sh
index 471dce3..499c0fb 100644
--- a/scripts/instance/instance_create.sh
+++ b/scripts/instance/instance_create.sh
@@ -279,10 +279,13 @@ _instanceRewriteCompose() {
         sed -i "s|${ph}|${news[$i]}|g" "$f"
     done
     # 2. The standalone app container (container_name: <type>) — anchored so the
-    #    image: line ending in <type> is never touched.
-    sed -i -E "s/(container_name:[[:space:]]*)${type}\b/\1${slug}/g" "$f"
+    #    image: line ending in <type> is never touched. Commented lines are skipped
+    #    for the same reason rule 1 skips them: a parked sidecar
+    #    (#  container_name: vaultwarden-exporter) is dead code, and half-renaming
+    #    it just leaves the block internally inconsistent.
+    sed -i -E "/^[[:space:]]*#/! s/(container_name:[[:space:]]*)${type}\b/\1${slug}/g" "$f"
     # 3. The files-backup label's container ref (libreportal.backup.files: "<type>:/...").
-    sed -i -E "s/(libreportal\.backup\.files:[[:space:]]*\")${type}\b/\1${slug}/g" "$f"
+    sed -i -E "/^[[:space:]]*#/! s/(libreportal\.backup\.files:[[:space:]]*\")${type}\b/\1${slug}/g" "$f"
     # 4. The per-app tag namespace. tagsProcessorAppConfigValues derives tag names
     #    mechanically from the config keys (CFG_<APP>_APP_KEY_1 -> the tag
     #    <APP>_APP_KEY_1_TAG), so a clone still carrying the TYPE's tag names has