diff --git a/Dockerfile b/Dockerfile
index 58c02bf..35be509 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,6 +18,12 @@ RUN SECRET_KEY=build-time-only-value-not-used-at-runtime-000000 \
     LDAP_CA_FILE=/app/README.md LDAP_PUBLISHER_GROUP_DN=build LDAP_ADMIN_GROUP_DN=build \
     /app/.venv/bin/python manage.py collectstatic --noinput
 
+# Not part of the runtime image: `docker compose --profile test run --rm live-test`
+FROM builder AS test
+RUN uv sync --frozen --no-install-project
+ENV PATH="/app/.venv/bin:$PATH"
+CMD ["python", "-m", "pytest", "portal/tests/test_directory_live.py", "-v", "-p", "no:cacheprovider"]
+
 FROM python:3.13-slim
 ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 PATH="/app/.venv/bin:$PATH"
 RUN apt-get update \
diff --git a/README.md b/README.md
index 8b05eb1..0c0647b 100644
--- a/README.md
+++ b/README.md
@@ -51,10 +51,13 @@ uv run ruff check .
 
 ### Directory adapter against the test OU
 
-`uv sync` builds `python-ldap`, which needs the OpenLDAP and SASL development libraries (the Docker image installs them). The automated tests use an in-memory fake and a stand-in for the `ldap` module, so they run anywhere. To check the real adapter against the test OU, run this on a Linux host with the libraries installed (never against the production OU):
+`uv sync` builds `python-ldap`, which needs the OpenLDAP and SASL development libraries (the Docker image installs them). The automated tests use an in-memory fake and a stand-in for the `ldap` module, so they run anywhere.
+
+To check the real adapter against the test OU (never the production OU), run the opt-in test container on the Linux host. It reads the `LDAP_*` values and `CA_FILE_HOST` from `.env`; the test user's current password comes from your shell:
 
 ```sh
-PORTAL_LIVE_LDAP=1 LIVE_LDAP_SERVER=... LIVE_LDAP_USER_OU_DN=... LIVE_LDAP_BIND_DN=...   LIVE_LDAP_BIND_PASSWORD=... LIVE_LDAP_CA_FILE=... LIVE_LDAP_PUBLISHER_GROUP_DN=...   LIVE_LDAP_ADMIN_GROUP_DN=... LIVE_LDAP_TEST_PASSWORD=<current password of ptest-user1>   uv run pytest portal/tests/test_directory_live.py -v
+LIVE_LDAP_TEST_PASSWORD=<current password of ptest-user1> \
+  docker compose --profile test run --rm live-test
 ```
 
 It restores what it writes and does not change any password.
diff --git a/compose.yaml b/compose.yaml
index 31edb71..7f4081c 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -17,6 +17,27 @@ services:
       - no-new-privileges:true
     restart: unless-stopped
 
+  # Opt-in checks against the test OU. Reads the LDAP_* values from .env; the test user's
+  # current password comes from the shell:
+  #   LIVE_LDAP_TEST_PASSWORD=... docker compose --profile test run --rm live-test
+  live-test:
+    profiles: ["test"]
+    build:
+      context: .
+      target: test
+    environment:
+      PORTAL_LIVE_LDAP: "1"
+      LIVE_LDAP_SERVER: ${LDAP_SERVER:-}
+      LIVE_LDAP_USER_OU_DN: ${LDAP_USER_OU_DN:-}
+      LIVE_LDAP_BIND_DN: ${LDAP_BIND_DN:-}
+      LIVE_LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-}
+      LIVE_LDAP_CA_FILE: /certs/ca.pem
+      LIVE_LDAP_PUBLISHER_GROUP_DN: ${LDAP_PUBLISHER_GROUP_DN:-}
+      LIVE_LDAP_ADMIN_GROUP_DN: ${LDAP_ADMIN_GROUP_DN:-}
+      LIVE_LDAP_TEST_PASSWORD:
+    volumes:
+      - ${CA_FILE_HOST:?set CA_FILE_HOST in .env}:/certs/ca.pem:ro
+
 volumes:
   data:
   backups: