diff --git a/README.md b/README.md
index 4a6d20d9..bbc372b0 100755
--- a/README.md
+++ b/README.md
@@ -53,8 +53,10 @@ composer install
 | `PHP_COMPILER_PHP` | PHP binary for tests and scripts (default: `php`, or `php8.2` if found) |
 | `PHP_COMPILER_EXT_DIR` | Directory containing `.so` extensions (default: `/usr/lib/php/20220829` on PHP 8.2) |
 | `PHP_COMPILER_LLVM_PATH` | Path to LLVM 9 `clang`, `ld`, and `libLLVM-9.so.1` (default: repo `.llvm/` after install) |
+| `PHP_COMPILER_SKIP_SERVE_TESTS` | Skip `ServeTest` / `ServeAotTest` (set on GitHub Actions; use in sandboxes that cannot bind TCP) |
+| `PHP_COMPILER_RUN_SERVE_TESTS` | Force HTTP serve integration tests even when loopback bind probe fails |
 
-`script/ci-local.sh` sets these automatically when `.llvm/libLLVM-9.so.1` exists.
+`script/ci-local.sh` sets LLVM paths automatically when `.llvm/libLLVM-9.so.1` exists. It probes `127.0.0.1` bind capability and runs `@group serve` tests when allowed. **GitHub Actions** sets `PHP_COMPILER_SKIP_SERVE_TESTS=1` because hosted runners often block listeners; **local and Docker CI** (`make test-docker`, `./script/docker-ci-local.sh`) must run those tests — do not export the skip variable there.
 
 ### Running tests on the host
 
@@ -103,7 +105,7 @@ docker build -f Docker/dev/ubuntu-22.04/Dockerfile -t php-compiler:22.04-dev .
 
 When you bind-mount the repo, a host `.llvm/` directory (if present) overrides the image toolchain; otherwise `PHP_COMPILER_LLVM_PATH` defaults to `/opt/llvm9` and JIT/AOT tests run without re-downloading.
 
-Run the full local CI suite inside the container (same as `./script/ci-local.sh` on the host):
+Run the full local CI suite inside the container (same as `./script/ci-local.sh` on the host). This includes HTTP serve integration tests (`ServeTest`, `ServeAotTest`) unless `PHP_COMPILER_SKIP_SERVE_TESTS=1` is set:
 
 ```console
 make test-docker
@@ -117,6 +119,8 @@ If the bind-mount shows an empty `/compiler` directory (some harness setups), us
 ./script/docker-ci-local.sh
 ```
 
+On sandboxes that cannot bind TCP ports, set `PHP_COMPILER_SKIP_SERVE_TESTS=1` before running CI (GitHub Actions does this automatically).
+
 Published tag (when available): `ghcr.io/PurHur/php-compiler:dev`. Override with `PHP_COMPILER_DEV_IMAGE`.
 
 Legacy Makefile targets use Ubuntu 16.04 / 18.04 images with PHP 7.4. For day-to-day development on a host with PHP 8.2, prefer the workflow above. Use `make test-18` for the 18.04 image once built.
diff --git a/script/can-bind-loopback.php b/script/can-bind-loopback.php
new file mode 100755
index 00000000..49736e43
--- /dev/null
+++ b/script/can-bind-loopback.php
@@ -0,0 +1,16 @@
+#!/usr/bin/env php
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Exit 0 when the process can bind a TCP listener on 127.0.0.1 (issue #234).
+ */
+$s = @stream_socket_server('tcp://127.0.0.1:0', $errno, $errstr);
+if (false === $s) {
+    fwrite(STDERR, "Cannot bind loopback: {$errstr} ({$errno})\n");
+    exit(1);
+}
+
+fclose($s);
+exit(0);
diff --git a/script/ci-local.sh b/script/ci-local.sh
index ecde508c..85f5621c 100755
--- a/script/ci-local.sh
+++ b/script/ci-local.sh
@@ -36,12 +36,41 @@ else
   echo "LLVM 9 missing: @group llvm tests (JIT, AOT, web AOT) are skipped. Run: script/install-llvm9.sh"
 fi
 
-# Full suite includes test/real/ServeTest.php (bin/serve.php HTTP). Set
-# PHP_COMPILER_SKIP_SERVE_TESTS=1 in sandboxes that cannot bind TCP ports.
+# HTTP serve integration tests (ServeTest, ServeAotTest) need loopback TCP.
+# GitHub Actions sets PHP_COMPILER_SKIP_SERVE_TESTS=1; local/Docker CI must not.
+can_bind_loopback() {
+  "$PHP_BIN" "${PHP_OPTS[@]}" script/can-bind-loopback.php
+}
+
+configure_serve_tests() {
+  if [[ -n "${PHP_COMPILER_SKIP_SERVE_TESTS:-}" ]]; then
+    echo "HTTP serve integration tests skipped (PHP_COMPILER_SKIP_SERVE_TESTS is set)."
+    return
+  fi
+  if [[ "${PHP_COMPILER_RUN_SERVE_TESTS:-}" == "1" ]]; then
+    echo "HTTP serve integration tests forced (PHP_COMPILER_RUN_SERVE_TESTS=1)."
+    return
+  fi
+  if can_bind_loopback; then
+    echo "Loopback TCP bind OK: ServeTest and ServeAotTest will run."
+    return
+  fi
+  export PHP_COMPILER_SKIP_SERVE_TESTS=1
+  echo "Cannot bind 127.0.0.1 — skipping @group serve tests."
+  echo "  Set PHP_COMPILER_RUN_SERVE_TESTS=1 to force, or PHP_COMPILER_SKIP_SERVE_TESTS=1 to silence."
+}
+
+configure_serve_tests
+
 echo "PHPUnit: VM, compliance (no LLVM), real-world (includes ExamplesCompileTest VM lint/smoke)..."
-"$PHP_BIN" "${PHP_OPTS[@]}" vendor/bin/phpunit --exclude-group llvm "$@"
+"$PHP_BIN" "${PHP_OPTS[@]}" vendor/bin/phpunit --exclude-group llvm,serve "$@"
+
+if [[ -z "${PHP_COMPILER_SKIP_SERVE_TESTS:-}" ]]; then
+  echo "PHPUnit: HTTP serve (bin/serve.php, phpc serve --aot)..."
+  "$PHP_BIN" "${PHP_OPTS[@]}" vendor/bin/phpunit --group serve "$@"
+fi
 
 if [[ -f "$LLVM_DIR/libLLVM-9.so.1" ]]; then
   echo "PHPUnit: JIT, AOT (web fixtures + examples, ExamplesCompileTest AOT lint)..."
-  "$PHP_BIN" "${PHP_OPTS[@]}" vendor/bin/phpunit --group llvm "$@"
+  "$PHP_BIN" "${PHP_OPTS[@]}" vendor/bin/phpunit --group llvm --exclude-group serve "$@"
 fi
diff --git a/test/real/ServeAotTest.php b/test/real/ServeAotTest.php
index f9ee843b..de418e45 100644
--- a/test/real/ServeAotTest.php
+++ b/test/real/ServeAotTest.php
@@ -10,6 +10,7 @@
  * Integration tests for phpc serve --aot (issue #213).
  *
  * @group llvm
+ * @group serve
  */
 final class ServeAotTest extends TestCase
 {
diff --git a/test/real/ServeTest.php b/test/real/ServeTest.php
index bc372293..0ccd30aa 100644
--- a/test/real/ServeTest.php
+++ b/test/real/ServeTest.php
@@ -8,6 +8,8 @@
 
 /**
  * Integration tests for bin/serve.php (issues #151, #152, #150).
+ *
+ * @group serve
  */
 final class ServeTest extends TestCase
 {