diff --git a/bootstrap/components/network.ts b/bootstrap/components/network.ts
index e9a7990..e99b188 100644
--- a/bootstrap/components/network.ts
+++ b/bootstrap/components/network.ts
@@ -16,6 +16,17 @@ export function deployNetwork(ctx: BaseCtx): docker.Network {
       attachable: true,
       ipamConfigs: [{ subnet: ctx.cfg.network.subnet }], // "172.30.0.0/24"
     },
-    { provider: ctx.provider, deleteBeforeReplace: true },
+    {
+      provider: ctx.provider,
+      deleteBeforeReplace: true,
+      // Docker auto-assigns the subnet's first host (.1) as the bridge gateway —
+      // a field we never declared, so a `pulumi up --refresh` surfaced it as a
+      // spurious ipamConfigs drift. `gateway` is ForceNew, so reconciling it
+      // (either by declaring it OR by applying the refreshed diff) would REPLACE
+      // the network and disconnect every container. The IPAM is immutable by
+      // design (subnet fixed by CONTRACT_003), so we ignore drift on it: plain
+      // `up` stays clean AND `up --refresh` no longer wants to recreate the net.
+      ignoreChanges: ["ipamConfigs"],
+    },
   );
 }