diff --git a/demo/index.js b/demo/index.js
index ed2d1b3..62df486 100644
--- a/demo/index.js
+++ b/demo/index.js
@@ -21,7 +21,8 @@ if (process.env.SNYK_TRIGGER_EXTRA_VULN) {
 // create a server with a known vulnerability
 const http = require('http');
 const st = require('st');
-const PORT = process.env.PORT || 3000;
+const ENV_PORT = process.env.PORT;
+const PORT = ENV_PORT !== undefined ? ENV_PORT : 3000;
 
 const server = http.createServer(
   st({
@@ -31,6 +32,7 @@ const server = http.createServer(
   })
 );
 
-server.listen(PORT, () => console.log(`Demo server started, hit http://localhost:${PORT}/hello.txt to try it`));
+server.listen(PORT, () => console.log(
+  `Demo server started, hit http://localhost:${server.address().port}/hello.txt to try it`));
 
 module.exports = server;
diff --git a/test/disable.test.js b/test/disable.test.js
index 8dd16c7..2cdb217 100644
--- a/test/disable.test.js
+++ b/test/disable.test.js
@@ -14,15 +14,18 @@ test('agent can be disabled', async (t) => {
   process.env.SNYK_HOMEBASE_URL = 'http://localhost:7000/api/v1/beacon';
   process.env.SNYK_BEACON_INTERVAL_MS = BEACON_INTERVAL_MS;
   process.env.SNYK_RUNTIME_AGENT_DISABLE = 'yes please';
+  // 0: let the OS pick a free port
+  process.env.PORT = 0;
 
   // bring up the demo server
   const demoApp = require('../demo');
+  const port = demoApp.address().port;
 
   // wait to let the agent go through a cycle
   await sleep(BEACON_INTERVAL_MS);
 
   // trigger the vuln method
-  await needle.get('http://localhost:3000/hello.txt');
+  await needle.get(`http://localhost:${port}/hello.txt`);
 
   // wait to let the agent go through a cycle
   await sleep(BEACON_INTERVAL_MS);
@@ -33,6 +36,7 @@ test('agent can be disabled', async (t) => {
   delete process.env.SNYK_HOMEBASE_URL;
   delete process.env.SNYK_BEACON_INTERVAL_MS;
   delete process.env.SNYK_RUNTIME_AGENT_DISABLE;
+  delete process.env.PORT;
 
   await new Promise((resolve) => demoApp.close(resolve));
 });
diff --git a/test/e2e.test.js b/test/e2e.test.js
index e2be601..ffb4565 100644
--- a/test/e2e.test.js
+++ b/test/e2e.test.js
@@ -150,15 +150,18 @@ test('demo app reports a vuln method when called', async (t) => {
   process.env.SNYK_BEACON_INTERVAL_MS = BEACON_INTERVAL_MS;
   process.env.SNYK_SNAPSHOT_INTERVAL_MS = SNAPSHOT_INTERVAL_MS;
   process.env.SNYK_TRIGGER_EXTRA_VULN = true;
+  // 0: let the OS pick a free port
+  process.env.PORT = 0;
 
   // bring up the demo server
   const demoApp = require('../demo');
+  const port = demoApp.address().port;
 
   // wait to let the agent go through a cycle
   await sleep(BEACON_INTERVAL_MS);
 
   // trigger the vuln method
-  await needle.get('http://localhost:3000/hello.txt');
+  await needle.get(`http://localhost:${port}/hello.txt`);
 
   // wait to let the agent go through a cycle
   await sleep(BEACON_INTERVAL_MS);
@@ -167,7 +170,7 @@ test('demo app reports a vuln method when called', async (t) => {
   await sleep(SNAPSHOT_INTERVAL_MS - BEACON_INTERVAL_MS * 2);
 
   // trigger the vuln method again
-  await needle.get('http://localhost:3000/hello.txt');
+  await needle.get(`http://localhost:${port}/hello.txt`);
 
   // wait to let the agent go through another cycle with a new snapshot
   await sleep(BEACON_INTERVAL_MS);
@@ -182,6 +185,7 @@ test('demo app reports a vuln method when called', async (t) => {
   delete process.env.SNYK_BEACON_INTERVAL_MS;
   delete process.env.SNYK_SNAPSHOT_INTERVAL_MS;
   delete process.env.SNYK_TRIGGER_EXTRA_VULN;
+  delete process.env.PORT;
 
   await new Promise((resolve) => demoApp.close(resolve));
 });
diff --git a/test/failures.test.js b/test/failures.test.js
index ad3fc99..ea33518 100644
--- a/test/failures.test.js
+++ b/test/failures.test.js
@@ -7,6 +7,8 @@ test('node agent does not crash the demo app', async (t) => {
   const BEACON_INTERVAL_MS = 1000;
   process.env.SNYK_HOMEBASE_URL = 'http://localhost:8000/api/v1/beacon';
   process.env.SNYK_BEACON_INTERVAL_MS = BEACON_INTERVAL_MS;
+  // 0: let the OS pick a free port
+  process.env.PORT = 0;
 
   // bring up the demo server, will fail on periodic tasks
   const demoApp = proxyquire('../demo', {
@@ -24,6 +26,7 @@ test('node agent does not crash the demo app', async (t) => {
 
   delete process.env.SNYK_HOMEBASE_URL;
   delete process.env.SNYK_BEACON_INTERVAL_MS;
+  delete process.env.PORT;
 
   await new Promise((resolve) => demoApp.close(resolve));
 });
@@ -33,6 +36,8 @@ test('node agent does not crash the demo app', async (t) => {
   process.env.SNYK_HOMEBASE_ORIGIN = 'http://localhost:-1';
   process.env.SNYK_BEACON_INTERVAL_MS = BEACON_INTERVAL_MS;
   process.env.SNYK_SNAPSHOT_INTERVAL_MS = 200;
+  // 0: let the OS pick a free port
+  process.env.PORT = 0;
 
   // bring up the demo server, will fail on any outgoing request
   const demoApp = require('../demo');
@@ -43,6 +48,7 @@ test('node agent does not crash the demo app', async (t) => {
   delete process.env.SNYK_HOMEBASE_ORIGIN;
   delete process.env.SNYK_SNAPSHOT_INTERVAL_MS;
   delete process.env.SNYK_BEACON_INTERVAL_MS;
+  delete process.env.PORT;
 
   await new Promise((resolve) => demoApp.close(resolve));
 });