diff --git a/docs/source/contributing.rst b/docs/source/contributing.rst
index 90266b1c2..8fa890e2f 100644
--- a/docs/source/contributing.rst
+++ b/docs/source/contributing.rst
@@ -142,7 +142,7 @@ They use the Docker engine selected by the current Docker configuration by defau
 
 .. _socktainer-setup:
 
-To run the same tests with Apple's container runtime, complete the runtime installation steps in :ref:`apple-container-setup`, then install `Socktainer`_ 1.5.1 or later.
+To run the same tests with Apple's container runtime, complete the runtime installation steps in :ref:`apple-container-setup`, then install `Socktainer`_ 1.5.2 or later.
 It provides the Docker-compatible API used by the Python deployment tests:
 
 .. code-block:: console
@@ -151,29 +151,24 @@ It provides the Docker-compatible API used by the Python deployment tests:
    $ socktainer --no-auto-start --no-docker-context
 
 Keep Socktainer running in that terminal.
-In another terminal, select its socket and API version for the test command:
+In another terminal, select its socket for the test command:
 
 .. code-block:: console
 
    $ DOCKER_HOST="unix://$HOME/.socktainer/container.sock" \
-       DOCKER_API_VERSION=1.51 \
        uv run --group=dev pytest tests/mock_vws/test_docker.py
 
-Socktainer 1.5.1 requires the explicit API version because its automatic version negotiation is incompatible with the Docker Python SDK.
-This is tracked in `Socktainer issue 433`_.
-The deployment tests automatically negotiate the API version when ``DOCKER_API_VERSION`` is unset.
+The deployment tests automatically negotiate the API version.
 
 Both configurations exercise native health checks, published HTTP ports, application behavior and restarts.
 Running the mock directly with Apple's CLI uses the same images and is documented in :ref:`apple-container-setup`.
-The tests bind their published ports to loopback explicitly because Socktainer 1.5.1 ignores automatic port publishing.
-See `Socktainer issue 434`_.
+Target-manager and VWQ use automatically published ports.
+VWS keeps an explicit loopback binding so its report download URLs are known before startup.
 Test containers, image tags and networks are removed after the run, including when setup fails.
 Hosted CI continues to use Docker.
 Apple deployment validation runs on a local Mac.
 
 .. _Socktainer: https://github.com/socktainer/socktainer
-.. _Socktainer issue 433: https://github.com/socktainer/socktainer/issues/433
-.. _Socktainer issue 434: https://github.com/socktainer/socktainer/issues/434
 
 
 Verifying signed Model Target requests
diff --git a/tests/mock_vws/test_docker.py b/tests/mock_vws/test_docker.py
index b0bea3318..367f1a363 100644
--- a/tests/mock_vws/test_docker.py
+++ b/tests/mock_vws/test_docker.py
@@ -11,7 +11,6 @@
 import datetime
 import io
 import json
-import os
 import socket
 import uuid
 import zipfile
@@ -282,25 +281,10 @@ def _vws_client(
     )
 
 
-@beartype
-def _docker_client() -> docker.DockerClient:
-    """Return a client for the Docker API engine selected by the
-    environment.
-
-    Returns:
-        A client using the requested API version, or automatic negotiation.
-    """
-    # Socktainer needs an explicit API version until negotiation is fixed:
-    # https://github.com/socktainer/socktainer/issues/433
-    return docker.from_env(
-        version=os.environ.get(key="DOCKER_API_VERSION", default="auto"),
-    )
-
-
 @beartype
 def _create_bridge_network(*, resources: ExitStack) -> Network:
     """Create a test network and register its removal immediately."""
-    client = _docker_client()
+    client = docker.from_env()
     name = "test-vws-bridge-" + uuid.uuid4().hex
     try:
         network = client.networks.create(name=name, driver="bridge")
@@ -325,7 +309,7 @@ def _build_image(
     Returns:
         The built image.
     """
-    client = _docker_client()
+    client = docker.from_env()
     dockerfile = f"{repository_root}/src/mock_vws/_flask_server/Dockerfile"
     try:
         image, _ = client.images.build(
@@ -387,7 +371,7 @@ def fixture_mock_deployment() -> Iterator[_MockDeployment]:
             start=Path(__file__).resolve(),
         )
     )
-    client = _docker_client()
+    client = docker.from_env()
     random = uuid.uuid4().hex
 
     with ExitStack() as resources:
@@ -420,13 +404,10 @@ def fixture_mock_deployment() -> Iterator[_MockDeployment]:
         vws_host_port = _free_port()
         base_vws_url = f"http://127.0.0.1:{vws_host_port}"
 
-        # Target-manager and VWQ need explicit ports while Socktainer ignores
-        # publish_all_ports=True:
-        # https://github.com/socktainer/socktainer/issues/434
         target_manager_container = client.containers.create(
             image=target_manager_image,
             name=target_manager_container_name,
-            ports={"5000/tcp": ("127.0.0.1", _free_port())},
+            publish_all_ports=True,
             network=custom_bridge_network.name,
         )
         _start_container(
@@ -448,7 +429,7 @@ def fixture_mock_deployment() -> Iterator[_MockDeployment]:
         vwq_container = client.containers.create(
             image=vwq_image,
             name="vws-mock-vwq-" + random,
-            ports={"5000/tcp": ("127.0.0.1", _free_port())},
+            publish_all_ports=True,
             network=custom_bridge_network.name,
             environment={
                 "TARGET_MANAGER_BASE_URL": target_manager_internal_base_url,