diff --git a/testing/ci-local.sh b/testing/ci-local.sh
index d0330df..b02a23b 100755
--- a/testing/ci-local.sh
+++ b/testing/ci-local.sh
@@ -429,6 +429,7 @@ ci_teardown() {
     if [[ $run_status -eq 0 && -n "${CI_RUN_NAME_SUFFIX:-}" ]]; then
         rm -rf "$SCRIPT_DIR/static/generated-configs${CI_RUN_NAME_SUFFIX}"
         rm -rf "$SCRIPT_DIR/firewall/generated-configs${CI_RUN_NAME_SUFFIX}"
+        rm -rf "$SCRIPT_DIR/nat/generated-configs${CI_RUN_NAME_SUFFIX}"
     fi
 
     # 4. This run's build context. Unlike the generated configs it is removed
diff --git a/testing/nat/.gitignore b/testing/nat/.gitignore
index 31315f6..b06c7df 100644
--- a/testing/nat/.gitignore
+++ b/testing/nat/.gitignore
@@ -1 +1 @@
-generated-configs
+generated-configs*
diff --git a/testing/nat/docker-compose.yml b/testing/nat/docker-compose.yml
index d428ecc..0dd3055 100644
--- a/testing/nat/docker-compose.yml
+++ b/testing/nat/docker-compose.yml
@@ -126,7 +126,7 @@ services:
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
       - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
-      - ./generated-configs/cone/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/cone/node-a.yaml:/etc/fips/fips.yaml:ro
     network_mode: none
 
   cone-b:
@@ -152,7 +152,7 @@ services:
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
       - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
-      - ./generated-configs/cone/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/cone/node-b.yaml:/etc/fips/fips.yaml:ro
     network_mode: none
 
   symmetric-a:
@@ -178,7 +178,7 @@ services:
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
       - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
-      - ./generated-configs/symmetric/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/symmetric/node-a.yaml:/etc/fips/fips.yaml:ro
     network_mode: none
 
   symmetric-b:
@@ -204,7 +204,7 @@ services:
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
       - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
-      - ./generated-configs/symmetric/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/symmetric/node-b.yaml:/etc/fips/fips.yaml:ro
     network_mode: none
 
   lan-a:
@@ -217,7 +217,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/lan/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/lan/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.10
@@ -232,7 +232,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/lan/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/lan/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.11
@@ -254,7 +254,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/nostr-publish-consume/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/nostr-publish-consume/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.20
@@ -269,7 +269,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/nostr-publish-consume/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/nostr-publish-consume/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.21
@@ -298,7 +298,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/stun-faults/stun-fault-node.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/stun-faults/stun-fault-node.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.50
@@ -319,7 +319,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/stun-faults/stun-fault-peer.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/stun-faults/stun-fault-peer.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.51
diff --git a/testing/nat/scripts/generate-configs.sh b/testing/nat/scripts/generate-configs.sh
index b307d95..ec4c40f 100755
--- a/testing/nat/scripts/generate-configs.sh
+++ b/testing/nat/scripts/generate-configs.sh
@@ -6,7 +6,12 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 NAT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 ROOT_DIR="$(cd "$NAT_DIR/../.." && pwd)"
 DERIVE_KEYS="$ROOT_DIR/testing/lib/derive_keys.py"
-OUTPUT_DIR="$NAT_DIR/generated-configs"
+# Per-run, for the same reason static's and firewall's generators are: this
+# directory is bind-mounted by compose and read back by the suite scripts
+# AFTER the containers are up, so a shared path lets a second run's generator
+# overwrite the npubs a first run is about to ping. Empty suffix renders
+# today's plain path, so a bare invocation is unchanged.
+OUTPUT_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 SCENARIO="${1:?usage: generate-configs.sh <cone|symmetric|lan> [mesh-name]}"
 MESH_NAME="${2:-nat-lab-$(date +%s)-$$}"
 
diff --git a/testing/nat/scripts/nat-test.sh b/testing/nat/scripts/nat-test.sh
index c1eea64..a64cd44 100755
--- a/testing/nat/scripts/nat-test.sh
+++ b/testing/nat/scripts/nat-test.sh
@@ -9,6 +9,10 @@ BUILD_SCRIPT="$ROOT_DIR/testing/scripts/build.sh"
 GENERATE_SCRIPT="$SCRIPT_DIR/generate-configs.sh"
 TOPOLOGY_SCRIPT="$SCRIPT_DIR/setup-topology.sh"
 WAIT_LIB="$ROOT_DIR/testing/lib/wait-converge.sh"
+# Must track generate-configs.sh's OUTPUT_DIR and the compose bind-mounts: the
+# npubs are read back here after the containers are up, so reading a different
+# directory than the one the generator wrote pings an npub no node owns.
+CONFIG_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 
 SCENARIO="${1:-all}"
 COMPOSE=(docker compose -f "$NAT_DIR/docker-compose.yml")
@@ -358,7 +362,7 @@ run_cone() {
     assert_link_path fips-nat-cone-a${FIPS_CI_NAME_SUFFIX:-} 172.31.254.
     assert_link_path fips-nat-cone-b${FIPS_CI_NAME_SUFFIX:-} 172.31.254.
     # shellcheck disable=SC1090
-    source "$NAT_DIR/generated-configs/cone/npubs.env"
+    source "$CONFIG_DIR/cone/npubs.env"
     ping_peer fips-nat-cone-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B"
     ping_peer fips-nat-cone-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A"
     cleanup
@@ -385,7 +389,7 @@ run_symmetric() {
     require_bootstrap_activity fips-nat-symmetric-a${FIPS_CI_NAME_SUFFIX:-}
     require_bootstrap_activity fips-nat-symmetric-b${FIPS_CI_NAME_SUFFIX:-}
     # shellcheck disable=SC1090
-    source "$NAT_DIR/generated-configs/symmetric/npubs.env"
+    source "$CONFIG_DIR/symmetric/npubs.env"
     ping_peer fips-nat-symmetric-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B"
     ping_peer fips-nat-symmetric-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A"
     cleanup
@@ -409,7 +413,7 @@ run_lan() {
     assert_link_path fips-nat-lan-a${FIPS_CI_NAME_SUFFIX:-} 172.31.10.
     assert_link_path fips-nat-lan-b${FIPS_CI_NAME_SUFFIX:-} 172.31.10.
     # shellcheck disable=SC1090
-    source "$NAT_DIR/generated-configs/lan/npubs.env"
+    source "$CONFIG_DIR/lan/npubs.env"
     ping_peer fips-nat-lan-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B"
     ping_peer fips-nat-lan-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A"
     # Skip the final teardown when the mesh-lab harness wraps this
diff --git a/testing/nat/scripts/nostr-relay-test.sh b/testing/nat/scripts/nostr-relay-test.sh
index 718120d..26c0b9e 100755
--- a/testing/nat/scripts/nostr-relay-test.sh
+++ b/testing/nat/scripts/nostr-relay-test.sh
@@ -21,6 +21,8 @@ ROOT_DIR="$(cd "$NAT_DIR/../.." && pwd)"
 BUILD_SCRIPT="$ROOT_DIR/testing/scripts/build.sh"
 GENERATE_SCRIPT="$SCRIPT_DIR/generate-configs.sh"
 WAIT_LIB="$ROOT_DIR/testing/lib/wait-converge.sh"
+# Must track generate-configs.sh's OUTPUT_DIR and the compose bind-mounts.
+CONFIG_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 
 PROFILE="nostr-publish-consume"
 SCENARIO="$PROFILE"
@@ -342,7 +344,7 @@ run_test() {
     fi
 
     # shellcheck disable=SC1090
-    source "$NAT_DIR/generated-configs/$SCENARIO/npubs.env"
+    source "$CONFIG_DIR/$SCENARIO/npubs.env"
     echo "  NPUB_A=$NPUB_A"
     echo "  NPUB_B=$NPUB_B"