diff --git a/surfsense_desktop/package.json b/surfsense_desktop/package.json
index 750508124..bd0cc67ab 100644
--- a/surfsense_desktop/package.json
+++ b/surfsense_desktop/package.json
@@ -27,6 +27,7 @@
     "wait-on": "^9.0.4"
   },
   "dependencies": {
-    "electron-updater": "^6.8.3"
+    "electron-updater": "^6.8.3",
+    "get-port-please": "^3.2.0"
   }
 }
diff --git a/surfsense_desktop/pnpm-lock.yaml b/surfsense_desktop/pnpm-lock.yaml
index 654f927f2..ea65be0bb 100644
--- a/surfsense_desktop/pnpm-lock.yaml
+++ b/surfsense_desktop/pnpm-lock.yaml
@@ -11,6 +11,9 @@ importers:
       electron-updater:
         specifier: ^6.8.3
         version: 6.8.3
+      get-port-please:
+        specifier: ^3.2.0
+        version: 3.2.0
     devDependencies:
       '@types/node':
         specifier: ^25.5.0
@@ -793,6 +796,9 @@ packages:
     resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
     engines: {node: '>= 0.4'}
 
+  get-port-please@3.2.0:
+    resolution: {integrity: sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A==}
+
   get-proto@1.0.1:
     resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
     engines: {node: '>= 0.4'}
@@ -2415,6 +2421,8 @@ snapshots:
       hasown: 2.0.2
       math-intrinsics: 1.1.0
 
+  get-port-please@3.2.0: {}
+
   get-proto@1.0.1:
     dependencies:
       dunder-proto: 1.0.1
diff --git a/surfsense_desktop/src/main.ts b/surfsense_desktop/src/main.ts
index b3782e29b..fa5999ee9 100644
--- a/surfsense_desktop/src/main.ts
+++ b/surfsense_desktop/src/main.ts
@@ -1,10 +1,11 @@
 import { app, BrowserWindow, shell, ipcMain, session } from 'electron';
 import path from 'path';
+import { getPort } from 'get-port-please';
 
 const isDev = !app.isPackaged;
 let mainWindow: BrowserWindow | null = null;
 let deepLinkUrl: string | null = null;
-let serverPort: number = 3000;
+let serverPort: number = 3000; // overwritten at startup with a free port
 
 const PROTOCOL = 'surfsense';
 // Injected at compile time from .env.desktop via esbuild define
@@ -33,6 +34,9 @@ async function waitForServer(url: string, maxRetries = 60): Promise<boolean> {
 async function startNextServer(): Promise<void> {
   if (isDev) return;
 
+  serverPort = await getPort({ port: 3000, portRange: [30_011, 50_000] });
+  console.log(`Selected port ${serverPort}`);
+
   const standalonePath = getStandalonePath();
   const serverScript = path.join(standalonePath, 'server.js');