diff --git a/device/device_test.go b/device/device_test.go
index 5ea5410..016a0ca 100644
--- a/device/device_test.go
+++ b/device/device_test.go
@@ -8,6 +8,7 @@ package device
 import (
 	"bufio"
 	"bytes"
+	"fmt"
 	"net"
 	"strings"
 	"testing"
@@ -16,16 +17,30 @@ import (
 	"golang.zx2c4.com/wireguard/tun/tuntest"
 )
 
+func getFreePort(t *testing.T) string {
+	l, err := net.ListenPacket("udp", "localhost:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer l.Close()
+	return fmt.Sprintf("%d", l.LocalAddr().(*net.UDPAddr).Port)
+}
+
 func TestTwoDevicePing(t *testing.T) {
-	// TODO(crawshaw): pick unused ports on localhost
+	port1 := getFreePort(t)
+	port2 := getFreePort(t)
+
 	cfg1 := `private_key=481eb0d8113a4a5da532d2c3e9c14b53c8454b34ab109676f6b58c2245e37b58
-listen_port=53511
+listen_port={{PORT1}}
 replace_peers=true
 public_key=f70dbb6b1b92a1dde1c783b297016af3f572fef13b0abb16a2623d89a58e9725
 protocol_version=1
 replace_allowed_ips=true
 allowed_ip=1.0.0.2/32
-endpoint=127.0.0.1:53512`
+endpoint=127.0.0.1:{{PORT2}}`
+	cfg1 = strings.ReplaceAll(cfg1, "{{PORT1}}", port1)
+	cfg1 = strings.ReplaceAll(cfg1, "{{PORT2}}", port2)
+
 	tun1 := tuntest.NewChannelTUN()
 	dev1 := NewDevice(tun1.TUN(), NewLogger(LogLevelDebug, "dev1: "))
 	dev1.Up()
@@ -35,13 +50,16 @@ endpoint=127.0.0.1:53512`
 	}
 
 	cfg2 := `private_key=98c7989b1661a0d64fd6af3502000f87716b7c4bbcf00d04fc6073aa7b539768
-listen_port=53512
+listen_port={{PORT2}}
 replace_peers=true
 public_key=49e80929259cebdda4f322d6d2b1a6fad819d603acd26fd5d845e7a123036427
 protocol_version=1
 replace_allowed_ips=true
 allowed_ip=1.0.0.1/32
-endpoint=127.0.0.1:53511`
+endpoint=127.0.0.1:{{PORT1}}`
+	cfg2 = strings.ReplaceAll(cfg2, "{{PORT1}}", port1)
+	cfg2 = strings.ReplaceAll(cfg2, "{{PORT2}}", port2)
+
 	tun2 := tuntest.NewChannelTUN()
 	dev2 := NewDevice(tun2.TUN(), NewLogger(LogLevelDebug, "dev2: "))
 	dev2.Up()