diff --git a/tests/certification/pubsub/pulsar/config/docker-compose_auth-mock-oidc-server.yaml b/tests/certification/pubsub/pulsar/config/docker-compose_auth-mock-oidc-server.yaml
index fa74a61444..220011d949 100644
--- a/tests/certification/pubsub/pulsar/config/docker-compose_auth-mock-oidc-server.yaml
+++ b/tests/certification/pubsub/pulsar/config/docker-compose_auth-mock-oidc-server.yaml
@@ -1,3 +1,6 @@
+# We run in network_mode: "host" so `localhost` is the same for both the host
+# and containers. This is required as the mock server uses the SNI hostname to
+# build the issuer URL.
 version: '3'
 services:
   mock-oauth2-server:
@@ -9,5 +12,3 @@ services:
       - PORT=8085
       - LOG_LEVEL=DEBUG
       - 'JSON_CONFIG={"interactiveLogin":false,"httpServer":{"type":"NettyWrapper","ssl":{}},"tokenCallbacks":[{"issuerId":"issuer1","tokenExpiry":120,"requestMappings":[{"requestParam":"scope","match":"openid","claims":{"sub":"foo","aud":["pulsar"]}}]}]}'
-    ports:
-      - "8085:8085"
diff --git a/tests/certification/pubsub/pulsar/config/docker-compose_auth-oidc.yaml.tmpl b/tests/certification/pubsub/pulsar/config/docker-compose_auth-oidc.yaml.tmpl
index f9f1dc2d4e..c1c0ceb290 100644
--- a/tests/certification/pubsub/pulsar/config/docker-compose_auth-oidc.yaml.tmpl
+++ b/tests/certification/pubsub/pulsar/config/docker-compose_auth-oidc.yaml.tmpl
@@ -96,9 +96,6 @@ services:
         condition: service_healthy
       bookie:
         condition: service_started
-    ports:
-      - "6650:6650"
-      - "8080:8080"
     command: bash -c "bin/apply-config-from-env.py conf/broker.conf && exec bin/pulsar broker"
 
 volumes: