diff --git a/Makefile b/Makefile
index bfb9d60..5b65614 100644
--- a/Makefile
+++ b/Makefile
@@ -152,8 +152,12 @@ proto: container-check ## Regenerate Go + Python protobuf bindings via container
 #   Postgres       14432
 #   Temporal       14733
 #   Temporal UI    14080
-#   MQTT           14883
-#   MQTT dashboard 14093
+#   MQTT           7883   (cloudflared tunnel listener — *host*-side,
+#                          not a lab container; bring up cloudflared
+#                          before make sim-up. Run a local broker
+#                          instead with: docker compose --profile
+#                          internal-broker up -d)
+#   MQTT dashboard 14093  (only when --profile internal-broker)
 #   Registry       14050
 #
 # Override any of POSTGRES_PORT TEMPORAL_PORT TEMPORAL_UI_PORT MQTT_PORT
@@ -176,7 +180,7 @@ lab-down: container-check ## Tear down local lab stack
 .PHONY: lab-status
 lab-status: ## Probe lab services
 	@LAB_TEMPORAL_UI_PORT="$${TEMPORAL_UI_PORT:-14080}"; \
-	 LAB_MQTT_PORT="$${MQTT_PORT:-14883}"; \
+	 LAB_MQTT_PORT="$${MQTT_PORT:-7883}"; \
 	 LAB_POSTGRES_PORT="$${POSTGRES_PORT:-14432}"; \
 	 LAB_REGISTRY_PORT="$${REGISTRY_PORT:-14050}"; \
 	 echo "--- engine: $(CONTAINER_ENGINE) (compose: $(COMPOSE)) ---"; \
@@ -274,18 +278,23 @@ sim-drive-stop: ## Stop the rover
 #   Registry       25050
 # =============================================================================
 
-CI_PROJECT := temporal-hack-ci
-CI_FILES   := -f docker-compose.yml -f docker-compose.ci.yml
+CI_PROJECT  := temporal-hack-ci
+CI_FILES    := -f docker-compose.yml -f docker-compose.ci.yml
+# CI runners don't have the developer's cloudflared MQTT tunnel,
+# so the CI smoke ALWAYS includes the internal-broker profile —
+# this brings up EMQX inside the compose project for the duration
+# of the test.
+CI_PROFILES := --profile internal-broker
 
 .PHONY: ci-up
 ci-up: container-check ## Bring up an isolated CI/smoke cluster on alternate ports
 	@echo "[$(CONTAINER_ENGINE)] bringing up CI stack on alt ports"
 	cd installer/docker-compose && CONTAINER_SOCK=$(CONTAINER_SOCK) \
-	  $(COMPOSE) -p $(CI_PROJECT) $(CI_FILES) up -d --wait
+	  $(COMPOSE) -p $(CI_PROJECT) $(CI_PROFILES) $(CI_FILES) up -d --wait
 
 .PHONY: ci-down
 ci-down: container-check ## Tear down the CI/smoke cluster (and wipe its volumes)
-	cd installer/docker-compose && $(COMPOSE) -p $(CI_PROJECT) $(CI_FILES) down -v
+	cd installer/docker-compose && $(COMPOSE) -p $(CI_PROJECT) $(CI_PROFILES) $(CI_FILES) down -v
 
 .PHONY: ci-status
 ci-status: ## Probe CI services on their alternate ports
diff --git a/ONBOARDING.md b/ONBOARDING.md
index acbb3ce..035e669 100644
--- a/ONBOARDING.md
+++ b/ONBOARDING.md
@@ -258,7 +258,7 @@ All four services should report `up` on the 14xxx port range:
 
 ```
 Temporal UI:    up   (:14080)
-MQTT broker:    up   (:14883)
+MQTT broker:    up   (:7883)
 Postgres:       up   (:14432)
 Registry:       up   (:14050)
 ```
diff --git a/README.md b/README.md
index d9cc71f..0fc8b66 100644
--- a/README.md
+++ b/README.md
@@ -96,7 +96,7 @@ docker push localhost:5001/robot-app:v1
 # Or: make dummy-robot-image   (same; requires lab registry + insecure-registries for HTTP)
 
 # Run the OTA worker (separate terminal)
-TEMPORAL_ADDR=localhost:14733 BROKER_URL=tcp://localhost:14883 \
+TEMPORAL_ADDR=localhost:14733 BROKER_URL=tcp://localhost:7883 \
   TSDB_DSN="postgres://temporal:temporal@localhost:14432/telemetry?sslmode=disable" \
   ./bin/ota-worker
 
diff --git a/installer/README.md b/installer/README.md
index a00a0fa..8e57f31 100644
--- a/installer/README.md
+++ b/installer/README.md
@@ -67,7 +67,7 @@ Default ports:
 | Postgres          | 14432    | 25432   |
 | Temporal frontend | 14733    | 27233   |
 | Temporal UI       | 14080    | 28080   |
-| MQTT              | 14883    | 21883   |
+| MQTT              | 7883    | 21883   |
 | MQTT dashboard    | 14093    | 28083   |
 | Registry          | 14050    | 25050   |
 
diff --git a/installer/docker-compose/docker-compose.sim.yml b/installer/docker-compose/docker-compose.sim.yml
index 9b4f37f..bc5ea3b 100644
--- a/installer/docker-compose/docker-compose.sim.yml
+++ b/installer/docker-compose/docker-compose.sim.yml
@@ -35,16 +35,22 @@ services:
   agent:
     image: golang:1.22-bookworm
     depends_on:
-      mqtt:
-        condition: service_healthy
       sim:
         condition: service_started
+    # `host.docker.internal` resolves to the host bridge so the agent
+    # can reach the developer's cloudflared MQTT tunnel listener on
+    # 127.0.0.1:7883. Podman supports `host.containers.internal`
+    # automatically; for Docker we add the alias via extra_hosts.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     working_dir: /src/agent
     environment:
       ROBOT_ID: sim-robot-01
-      # mqtt and sim are sibling services on the same Compose network;
-      # the agent uses the canonical container-internal ports.
-      BROKER_URL: tcp://mqtt:1883
+      # The lab no longer runs its own EMQX. The MQTT broker is
+      # whatever cloudflared exposes on the host's port 7883
+      # (matching MQTT_PORT in docker-compose.yml). Override
+      # BROKER_URL if you tunnel to a different host/port.
+      BROKER_URL: ${BROKER_URL:-tcp://host.docker.internal:7883}
       BUFFER_PATH: /var/lib/agent/buffer.db
       BRIDGE_ADDR: unix:///run/bridge/temporal-hack-bridge.sock
       # OTA-spawned robot-app containers must join the lab network and
diff --git a/installer/docker-compose/docker-compose.yml b/installer/docker-compose/docker-compose.yml
index 4c1af89..ae0f362 100644
--- a/installer/docker-compose/docker-compose.yml
+++ b/installer/docker-compose/docker-compose.yml
@@ -65,22 +65,21 @@ services:
     ports:
       - "${TEMPORAL_UI_PORT:-14080}:8080"
 
+  # Local EMQX broker — disabled by default. The lab now consumes
+  # the developer's externally-tunneled MQTT broker via cloudflared
+  # listening on 127.0.0.1:${MQTT_PORT:-7883}. Bring this back with
+  # `--profile internal-broker` when you need a local broker (CI,
+  # offline dev, etc.):
+  #   docker compose --profile internal-broker up -d
   mqtt:
-    # EMQX 5.x defaults: anonymous auth, listener on 1883, dashboard on
-    # 18083 — exactly the v1 lab posture. We do NOT mount a custom
-    # emqx.conf for the lab because the file format is volatile across
-    # 5.x point releases (e.g. session_persistence vs durable_sessions).
-    # See deploy/mqtt/emqx.conf.example for the production-target
-    # config reference; production installer renders it through a
-    # version-pinned schema check.
+    profiles: ["internal-broker"]
     image: emqx/emqx:5.7.1
     ports:
-      - "${MQTT_PORT:-14883}:1883"               # MQTT
-      - "${MQTT_DASHBOARD_PORT:-14093}:18083"    # dashboard
+      - "${MQTT_PORT:-7883}:1883"
+      - "${MQTT_DASHBOARD_PORT:-14093}:18083"
     volumes:
       - mqttdata:/opt/emqx/data
     healthcheck:
-      # `emqx ctl status` is the documented EMQX 5.x liveness check.
       test: ["CMD", "/opt/emqx/bin/emqx", "ctl", "status"]
       interval: 10s
       timeout: 5s