diff --git a/playbooks/upgrade-docker-ce.yaml b/playbooks/upgrade-docker-ce.yaml
index c1d4e25..66a4aa6 100644
--- a/playbooks/upgrade-docker-ce.yaml
+++ b/playbooks/upgrade-docker-ce.yaml
@@ -126,6 +126,22 @@ steps:
     shell: DEBIAN_FRONTEND=noninteractive apt-get install -y {{ pkgs_to_install }}
     sudo: true
 
+  - name: Move aside any stale docker.service drop-in override
+    # The docker.io era often left an /etc/systemd/system/docker.service.d/
+    # override.conf adding `-H tcp://...` to ExecStart for remote docker
+    # discovery. After the swap, the override (a) hard-codes
+    # /usr/sbin/dockerd which no longer exists, and (b) duplicates the
+    # `hosts:` setting in /etc/docker/daemon.json — dockerd refuses to
+    # start when both are set ("conflicting host options"). daemon.json
+    # is the modern way; the override is redundant.
+    shell: |
+      f=/etc/systemd/system/docker.service.d/override.conf
+      if [ -f "$f" ]; then
+        echo "  moving aside $f"
+        sudo mv "$f" "${f}.pre-upgrade"
+      fi
+    sudo: true
+
   - name: systemctl daemon-reload (CRITICAL — package swap put dockerd at
       /usr/bin/dockerd; without reload, systemd keeps the old unit's
       ExecStart pointing at /usr/sbin/dockerd from docker.io and fails