diff --git a/src/shadowbox/integration_test/test.sh b/src/shadowbox/integration_test/test.sh
index 0f6adc84..84b194e6 100755
--- a/src/shadowbox/integration_test/test.sh
+++ b/src/shadowbox/integration_test/test.sh
@@ -100,13 +100,10 @@ function setup() {
   "${DOCKER}" run -d --rm -p "10080:80" --network="${NET_OPEN}" --network-alias="target" --name="${TARGET_CONTAINER}" "${TARGET_IMAGE}"
 
   # Shadowsocks service.
-  # Start on NET_OPEN first so that -p host port binding works on macOS Docker Desktop
-  # (Docker Desktop does not publish ports when the initial network is --internal).
-  # Then connect to NET_BLOCKED so the security isolation tests still pass.
   declare -ar shadowbox_flags=(
     -d
     --rm
-    --network="${NET_OPEN}"
+    --network="${NET_BLOCKED}"
     --network-alias="shadowbox"
     -p "20443:443"
     -e "SB_API_PORT=443"
@@ -121,7 +118,8 @@ function setup() {
     "${SHADOWBOX_IMAGE}"
   )
   "${DOCKER}" run "${shadowbox_flags[@]}"
-  "${DOCKER}" network connect --alias shadowbox "${NET_BLOCKED}" "${SHADOWBOX_CONTAINER}"
+  # "${DOCKER}" network connect --alias shadowbox "${NET_BLOCKED}" "${SHADOWBOX_CONTAINER}"
+  "${DOCKER}" network connect "${NET_OPEN}" "${SHADOWBOX_CONTAINER}"
 
   # Client service.
   "${DOCKER}" build --force-rm -t "${CLIENT_IMAGE}" "$(dirname "$0")/client"