diff --git a/.dockerignore b/.dockerignore
index 45c9b38..f5ac19a 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -5,3 +5,4 @@ dist
 backend
 data
 .zed
+docker-compose*.yml
diff --git a/README.md b/README.md
index ea8d2ce..56400ef 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,7 @@ service (see `nginx.conf` + `docker-compose.yml`).
 pnpm install
 pnpm dev                                  # frontend on :5173 (proxies /api -> :8000)
 cd backend && pnpm install && pnpm dev    # API on :8000
-# …or run the whole stack in containers:
+# …or run the whole stack in containers (open http://localhost:8080):
 docker compose up --build
 ```
 
diff --git a/docker-compose.override.yml b/docker-compose.override.yml
new file mode 100644
index 0000000..292159d
--- /dev/null
+++ b/docker-compose.override.yml
@@ -0,0 +1,11 @@
+# Local-only host port bindings for `docker compose up`. Docker Compose
+# auto-merges this file locally; Coolify runs with an explicit
+# `-f docker-compose.yml`, so it ignores this override (no host-port conflicts
+# on the Coolify host). Open http://localhost:8080 after `docker compose up`.
+services:
+  web:
+    ports:
+      - "8080:80"
+  api:
+    ports:
+      - "8000:8000"
diff --git a/docker-compose.yml b/docker-compose.yml
index 428173c..0bad8b1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,11 @@
 services:
   web:
     build: .
-    ports:
-      - "80:80"
+    # No host port binding: Coolify's proxy routes the domain to this service
+    # over the internal network (see docker_compose_domains). Host bindings
+    # would collide with Coolify's own :80 / other apps on the host.
+    expose:
+      - "80"
     depends_on:
       - api
 
@@ -18,5 +21,7 @@ services:
       - SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN:-}
     volumes:
       - ./data:/app/data
-    ports:
-      - "8000:8000"
+    # Internal only — the web (nginx) service reaches it at http://api:8000 on
+    # the compose network. Not published to the host.
+    expose:
+      - "8000"