diff --git a/scripts/checks/requirements/check_docker_network.sh b/scripts/checks/requirements/check_docker_network.sh
index f498208..dd18be7 100755
--- a/scripts/checks/requirements/check_docker_network.sh
+++ b/scripts/checks/requirements/check_docker_network.sh
@@ -1,11 +1,14 @@
 #!/bin/bash
 
 # CFG↔docker subnet adoption: if the docker network already exists with a
-# different /24 than CFG, treat docker's value as the truth and update CFG.
-# Apps' allocated IPs are still inside docker's subnet, so nothing else needs
-# re-IPing. (A genuine user-initiated subnet change is a `libreportal app
-# install <name> --reset-network` per app — fresh compose + fresh IPs from
-# the new subnet via the standard idempotent install path.)
+# different subnet than CFG, treat docker's value as the truth and update CFG.
+# This realigns CFG ONLY — it does NOT touch already-allocated per-app IPs.
+# Because IPs are pinned to the first three octets of the old subnet
+# (ipFindAvailable), adopting a different /24 base strands every existing app
+# IP outside docker's real subnet. Those apps need re-IPing from the corrected
+# subnet: automatically via the network-drift detector + `libreportal system
+# network heal`, or manually per app via `libreportal app install <name>
+# --reset-network` (fresh compose + fresh IPs through the idempotent install).
 adoptDockerSubnet()
 {
 	local current_subnet="$1"
diff --git a/scripts/network/ip/ip_allocation.sh b/scripts/network/ip/ip_allocation.sh
index cf0f7d4..8c64903 100755
--- a/scripts/network/ip/ip_allocation.sh
+++ b/scripts/network/ip/ip_allocation.sh
@@ -23,6 +23,7 @@ ipAllocation()
             if [[ -z "$available_ip" ]]; then
                 isError "No available IP addresses in pool"
                 allocated_ip="$existing_ip"
+                return 1
             fi
             sqlite3 "$docker_dir/$db_file" \
                 "UPDATE network_resources \
@@ -33,6 +34,10 @@ ipAllocation()
         else
             allocated_ip="$existing_ip"
         fi
+        # An active row already exists for this app+service — reused or reset in
+        # place above. Don't fall through to the INSERT below: that second write
+        # would violate UNIQUE(app_name,resource_type,service_name).
+        return 0
     fi
 
     ipFindAvailable