diff --git a/modules/mssql/module.json b/modules/mssql/module.json
index d397c6b..bc64318 100644
--- a/modules/mssql/module.json
+++ b/modules/mssql/module.json
@@ -20,10 +20,10 @@
   ],
   "listens": [
     {
-      "port": 1433,
+      "port": 4848,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "modules on any machine that were granted a database"
+      "why": "modules on any machine that were granted a database. 4848, not 1433: the machine this replaces has served it there since it was installed, and every consumer was handed that number"
     }
   ],
   "serves": {
@@ -68,7 +68,7 @@
     {
       "id": "data",
       "type": "directory",
-      "path": "/services/mssql/db-data",
+      "path": "/services/mssql/data",
       "mode": "0700",
       "owner": "10001:0"
     },
@@ -81,16 +81,16 @@
       "id": "server",
       "type": "container",
       "name": "mssql",
-      "image": "mcr.microsoft.com/mssql/server@sha256:ba4c8329f48fb8f02e1416be6a930ebfd71268caee78aa985f3af4315e457c89",
+      "image": "mcr.microsoft.com/mssql/server@sha256:4402d880dd4c34bfa7d8705e56a86cd6c88da80a1f6bbbe741f999e76264a090",
       "network": "mssql",
       "env-file": [
         "/var/lib/mssql/sa.env"
       ],
       "ports": [
-        "1433"
+        "4848:1433"
       ],
       "volumes": [
-        "/services/mssql/db-data:/var/opt/mssql"
+        "/services/mssql/data:/var/opt/mssql"
       ],
       "secrets-in-environment": "the image documents only MSSQL_SA_PASSWORD, no _FILE and no configuration field; not convertible without a wrapper entrypoint"
     },