diff --git a/docs/STAGENET_FINANCIAL_CANARY.md b/docs/STAGENET_FINANCIAL_CANARY.md
index e5f2372..ca76ec2 100644
--- a/docs/STAGENET_FINANCIAL_CANARY.md
+++ b/docs/STAGENET_FINANCIAL_CANARY.md
@@ -42,7 +42,10 @@ Use two different stagenet wallets:
 1. The canary application owns the normal house wallet used to create invoice subaddresses and dispatch payouts.
 2. A separate, low-balance funding wallet sends the direct-entry payment and receives the payout.
 
-Expose only the separate funding wallet RPC to the harness, on loopback. Do not give the harness the house-wallet RPC URL or credentials. Keep the funding balance no larger than needed for the selected invoice plus fees.
+Expose only the separate funding wallet RPC to the harness, on loopback. Use a dedicated port such
+as `38085`; port `38083` belongs to the promoted house wallet and must not be reused by the funding
+wallet. Do not give the harness the house-wallet RPC URL or credentials. Keep the funding balance
+no larger than needed for the selected invoice plus fees.
 
 Before live use, independently verify that both wallet files are recoverable according to the operator's wallet-backup procedure. Do not put seeds, private keys, wallet passwords, transaction keys, or mnemonic output in this runbook, shell history, screenshots, CI variables, or canary logs. This harness deliberately does not inspect or print seed material.
 
@@ -145,7 +148,7 @@ E2E_TARGET=http://127.0.0.1:3102 \
 E2E_EXPECT_DATABASE=monerogue_canary_direct_e2e \
 E2E_DATABASE_URL_FILE=/run/credentials/canary/direct-database-url \
 E2E_DATABASE_NONCE_FILE=/run/credentials/canary/database-nonce \
-E2E_FUNDING_RPC_URL=http://127.0.0.1:38083 \
+E2E_FUNDING_RPC_URL=http://127.0.0.1:38085 \
 E2E_FUNDING_RPC_USER_FILE=/run/credentials/canary/funding-rpc-user \
 E2E_FUNDING_RPC_PASSWORD_FILE=/run/credentials/canary/funding-rpc-password \
 E2E_MAX_TRANSFER_ATOMIC=REPLACE_WITH_REVIEWED_ATOMIC_CEILING \
@@ -171,7 +174,7 @@ E2E_TARGET=http://127.0.0.1:3102 \
 E2E_EXPECT_DATABASE=monerogue_canary_treasure_e2e \
 E2E_DATABASE_URL_FILE=/run/credentials/canary/treasure-database-url \
 E2E_DATABASE_NONCE_FILE=/run/credentials/canary/database-nonce \
-E2E_FUNDING_RPC_URL=http://127.0.0.1:38083 \
+E2E_FUNDING_RPC_URL=http://127.0.0.1:38085 \
 E2E_FUNDING_RPC_USER_FILE=/run/credentials/canary/funding-rpc-user \
 E2E_FUNDING_RPC_PASSWORD_FILE=/run/credentials/canary/funding-rpc-password \
 E2E_MAX_TRANSFER_ATOMIC=REPLACE_WITH_REVIEWED_ATOMIC_CEILING \
diff --git a/test/stagenetFinancialCanary.test.js b/test/stagenetFinancialCanary.test.js
index 30d7d56..98d1d20 100644
--- a/test/stagenetFinancialCanary.test.js
+++ b/test/stagenetFinancialCanary.test.js
@@ -30,6 +30,7 @@ const {
 } = require('../src/services/canaryDatabaseIdentity');
 
 const SCRIPT = path.join(__dirname, '../src/scripts/stagenet-financial-canary.js');
+const RUNBOOK = path.join(__dirname, '../docs/STAGENET_FINANCIAL_CANARY.md');
 
 function configEnv(overrides = {}) {
     return {
@@ -475,4 +476,12 @@ describe('XMR stagenet financial canary safety contract', () => {
         expect(manifest.scripts['canary:stagenet'])
             .toBe('node scripts/stagenet-financial-canary.js');
     });
+
+    test('runbook keeps the separate funding wallet off the house-wallet RPC port', () => {
+        const runbook = fs.readFileSync(RUNBOOK, 'utf8');
+        expect(runbook).toContain('port `38083` belongs to the promoted house wallet');
+        expect(runbook).not.toContain('E2E_FUNDING_RPC_URL=http://127.0.0.1:38083');
+        expect(runbook.match(/E2E_FUNDING_RPC_URL=http:\/\/127\.0\.0\.1:38085/g))
+            .toHaveLength(2);
+    });
 });