diff --git a/cmd/ateapi/internal/controlapi/dialer_test.go b/cmd/ateapi/internal/controlapi/dialer_test.go
index 906106393a..43215e7942 100644
--- a/cmd/ateapi/internal/controlapi/dialer_test.go
+++ b/cmd/ateapi/internal/controlapi/dialer_test.go
@@ -24,12 +24,14 @@ import (
 	"errors"
 	"math/big"
 	"net/url"
+	"strconv"
 	"sync"
 	"testing"
 	"time"
 
 	"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
 	"github.com/spiffe/go-spiffe/v2/spiffeid"
+	"go.ate.dev/substrate/internal/atelet"
 	"go.ate.dev/substrate/internal/installdefaults"
 	"go.ate.dev/substrate/internal/substratex509"
 	"google.golang.org/grpc"
@@ -44,6 +46,9 @@ import (
 
 const testAteletSPIFFEID = "spiffe://cluster.local/ns/ate-system/sa/atelet"
 
+// ateletPort is the port every atelet dial target should carry.
+var ateletPort = strconv.Itoa(atelet.DefaultPort)
+
 // makeTestCA mints a self-signed CA and returns it along with an X.509 bundle
 // containing it as the sole authority for the cluster.local trust domain.
 func makeTestCA(t *testing.T) (*x509.Certificate, *ecdsa.PrivateKey, *x509bundle.Bundle) {
@@ -156,17 +161,17 @@ func TestDialForAteletOnNodeTarget(t *testing.T) {
 		{
 			name:       "IPv4 atelet",
 			ateletIP:   "10.244.1.7",
-			wantTarget: "10.244.1.7:8085",
+			wantTarget: "10.244.1.7:" + ateletPort,
 		},
 		{
 			name:       "IPv6 atelet is bracketed",
 			ateletIP:   "fd00:10:244::7",
-			wantTarget: "[fd00:10:244::7]:8085",
+			wantTarget: "[fd00:10:244::7]:" + ateletPort,
 		},
 		{
 			name:       "IPv6 loopback is bracketed",
 			ateletIP:   "::1",
-			wantTarget: "[::1]:8085",
+			wantTarget: "[::1]:" + ateletPort,
 		},
 	}
 
@@ -387,7 +392,7 @@ func TestDialForAteletOnNode(t *testing.T) {
 		if fresh == old {
 			t.Fatal("DialForAteletOnNode returned the stale connection after the IP changed")
 		}
-		if got, want := fresh.Target(), "10.0.0.9:8085"; got != want {
+		if got, want := fresh.Target(), "10.0.0.9:"+ateletPort; got != want {
 			t.Errorf("dial target = %q, want %q", got, want)
 		}
 		if got := old.GetState(); got != connectivity.Shutdown {
diff --git a/cmd/ateapi/internal/controlapi/functionaltest/main_test.go b/cmd/ateapi/internal/controlapi/functionaltest/main_test.go
index 9ea0ae0df7..1e2afe2830 100644
--- a/cmd/ateapi/internal/controlapi/functionaltest/main_test.go
+++ b/cmd/ateapi/internal/controlapi/functionaltest/main_test.go
@@ -20,11 +20,13 @@ import (
 	"log"
 	"net"
 	"os"
+	"strconv"
 	"sync"
 	"testing"
 	"time"
 
 	"go.ate.dev/substrate/cmd/ateapi/internal/store/storetest"
+	"go.ate.dev/substrate/internal/atelet"
 	"go.ate.dev/substrate/internal/objectstore/objectstoretest"
 	"go.ate.dev/substrate/internal/proto/ateletpb"
 	"go.ate.dev/substrate/internal/serverboot"
@@ -85,12 +87,13 @@ func TestMain(m *testing.M) {
 		log.Fatalf("%v", err)
 	}
 
-	// Start Fake Atelet Server on port 8085
+	// Start Fake Atelet Server on the port ateapi dials.
 	ateletGrpcServer := grpc.NewServer()
 	ateletpb.RegisterAteletServer(ateletGrpcServer, fakeAtelet)
-	ateletLis, err := net.Listen("tcp", "127.0.0.1:8085")
+	ateletAddr := net.JoinHostPort("127.0.0.1", strconv.Itoa(atelet.DefaultPort))
+	ateletLis, err := net.Listen("tcp", ateletAddr)
 	if err != nil {
-		log.Fatalf("listen on 127.0.0.1:8085: %v", err)
+		log.Fatalf("listen on %s: %v", ateletAddr, err)
 	}
 	go func() {
 		if err := ateletGrpcServer.Serve(ateletLis); err != nil {
diff --git a/docs/metrics/registry/metrics.yaml b/docs/metrics/registry/metrics.yaml
index 850cb3d1e0..5696a5b91f 100644
--- a/docs/metrics/registry/metrics.yaml
+++ b/docs/metrics/registry/metrics.yaml
@@ -704,7 +704,7 @@ groups:
         stability: stable
         type: int
         brief: The TCP port of the server that a gRPC client called.
-        examples: [8085]
+        examples: [21998]
 
   # ---------------------------------------------------------------------------
   # Metrics. ateapi
diff --git a/internal/atelet/port.go b/internal/atelet/port.go
index d89ad3adf4..e2a1a2c13e 100644
--- a/internal/atelet/port.go
+++ b/internal/atelet/port.go
@@ -16,5 +16,7 @@ package atelet
 
 const (
 	// DefaultPort is the port atelet's gRPC server listens on.
-	DefaultPort = 8085
+	// It is also atelet's hostPort, so it is chosen to avoid common node ports,
+	// the NodePort range, and the ephemeral range.
+	DefaultPort = 21998
 )
diff --git a/manifests/ate-install/atelet.yaml b/manifests/ate-install/atelet.yaml
index 7ff7371dd3..22581a3375 100644
--- a/manifests/ate-install/atelet.yaml
+++ b/manifests/ate-install/atelet.yaml
@@ -271,8 +271,8 @@ spec:
             name: ate-otel-config
         ports:
         - name: grpc
-          containerPort: 8085
-          hostPort: 8085
+          containerPort: 21998
+          hostPort: 21998
         - name: prometheus
           containerPort: 9090
           protocol: TCP
diff --git a/manifests/ate-install/components/fake-data-plane/kustomization.yaml b/manifests/ate-install/components/fake-data-plane/kustomization.yaml
index dcd5f803eb..9039c816c1 100644
--- a/manifests/ate-install/components/fake-data-plane/kustomization.yaml
+++ b/manifests/ate-install/components/fake-data-plane/kustomization.yaml
@@ -71,7 +71,7 @@ patches:
         path: /spec/template/spec/containers/0/ports
         value:
         - name: grpc
-          containerPort: 8085
+          containerPort: 21998
         # fake-workersync's capacity reports, relayed to ate-api-server under
         # this pod's atelet identity; only fake-workersync's is admitted.
         - name: relay