diff --git a/crates/quake/src/manifest/subnets.rs b/crates/quake/src/manifest/subnets.rs
index 8ee8bf5..cdaf8af 100644
--- a/crates/quake/src/manifest/subnets.rs
+++ b/crates/quake/src/manifest/subnets.rs
@@ -23,7 +23,7 @@ use crate::node::{CidrBlock, NodeName, SubnetName};
 
 /// Subnet index offset: user-defined subnets start at 172.21.x.x to avoid
 /// conflicting with the base Docker network at 172.19.x.x / 172.20.x.x.
-const SUBNET_INDEX_BASE: usize = 21;
+const SUBNET_INDEX_BASE: usize = 23;
 
 /// Subnets derived from the manifest.
 #[derive(Serialize, Clone, Debug, PartialEq, Default)]
@@ -353,8 +353,8 @@ mod tests {
         .into();
         let subnets = Subnets::new(&node_subnets);
         let cidr = subnets.cidr_map();
-        assert_eq!(cidr.get("A").unwrap(), "172.21.0.0/16");
-        assert_eq!(cidr.get("B").unwrap(), "172.22.0.0/16");
+        assert_eq!(cidr.get("A").unwrap(), "172.23.0.0/16");
+        assert_eq!(cidr.get("B").unwrap(), "172.24.0.0/16");
     }
 
     #[test]
@@ -368,7 +368,7 @@ mod tests {
         let subnets = Subnets::new(&node_subnets);
         assert_eq!(
             subnets.subnet_indexes_for("node2"),
-            vec![("A".to_string(), 21), ("B".to_string(), 22)]
+            vec![("A".to_string(), 23), ("B".to_string(), 24)]
         );
     }
 
diff --git a/crates/quake/templates/local/compose-monitoring.yaml.hbs b/crates/quake/templates/local/compose-monitoring.yaml.hbs
index f97ed79..f774fb5 100644
--- a/crates/quake/templates/local/compose-monitoring.yaml.hbs
+++ b/crates/quake/templates/local/compose-monitoring.yaml.hbs
@@ -64,4 +64,4 @@ networks:
     driver: bridge
     ipam:
       config:
-        - subnet: 172.20.0.0/16
+        - subnet: 172.22.0.0/16
diff --git a/crates/quake/templates/local/compose.yaml.hbs b/crates/quake/templates/local/compose.yaml.hbs
index d94e7eb..90ba9ca 100644
--- a/crates/quake/templates/local/compose.yaml.hbs
+++ b/crates/quake/templates/local/compose.yaml.hbs
@@ -446,7 +446,7 @@ networks:
     driver: bridge
     ipam:
       config:
-        - subnet: 172.20.0.0/16
+        - subnet: 172.22.0.0/16
   # Non-internal network for port publishing from containers on internal subnet networks
   host-access:
     driver: bridge