diff --git a/.env.example b/.env.example
index 919efb6..29c682b 100644
--- a/.env.example
+++ b/.env.example
@@ -99,6 +99,10 @@ WEBUI_SECRET_KEY=change-me-in-production
 #   Required for OAuth/SSO callback URLs.
 # WEBUI_URL=http://localhost:3000
 
+# WEBUI_PORT: the public-facing port to bind the service in Docker
+WEBUI_PORT=8080
+
+
 # -- OAuth / SSO (optional) ----------------------------------------------------
 # Uncomment and fill in to enable Google (or other OIDC) login.
 # ENABLE_OAUTH_SIGNUP=true
diff --git a/.gitignore b/.gitignore
index cbd68b1..206c641 100644
--- a/.gitignore
+++ b/.gitignore
@@ -136,6 +136,7 @@ celerybeat.pid
 
 # Environments
 .env
+.env.prod
 .envrc
 .venv
 env/
@@ -209,7 +210,7 @@ __marimo__/
 .DS_Store
 
 # Custom MCP Tooling spec YAML
-tooling_config.yml
+tooling_config*.yml
 
 CLAUDE.md
 .claude/
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 99cf7cc..5472a1d 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -4,8 +4,8 @@ services:
     image: ghcr.io/open-webui/open-webui:main
     container_name: openwebui
     ports:
-      - "100.97.183.107:3000:8080"
-      - "127.0.0.1:3000:8080"
+      - "100.97.183.107:${WEBUI_PORT}:8080"
+      - "127.0.0.1:${WEBUI_PORT}:8080"
     networks:
       - dev_lab
     restart: unless-stopped
@@ -30,6 +30,7 @@ services:
       ENABLE_FOLLOW_UP_GENERATION: ${ENABLE_FOLLOW_UP_GENERATION}
       WEBUI_SECRET_KEY: ${WEBUI_SECRET_KEY}
       WEBUI_URL: ${WEBUI_URL}
+      WEBUI_PORT: ${WEBUI_PORT}
       ENABLE_OAUTH_SIGNUP: ${ENABLE_OAUTH_SIGNUP}
       ENABLE_OAUTH_ID_TOKEN_COOKIE: ${ENABLE_OAUTH_ID_TOKEN_COOKIE}
       ENABLE_OAUTH_PERSISTENT_CONFIG: ${ENABLE_OAUTH_PERSISTENT_CONFIG}
@@ -48,6 +49,8 @@ services:
       - "traefik.http.routers.openwebui.rule=Host(`openwebui.trashcollector.dev`)"
       - "traefik.http.routers.openwebui.entrypoints=https"
       - "traefik.http.routers.openwebui.tls.certresolver=letsencrypt"
+      - "traefik.http.services.openwebui.loadbalancer.server.port=8080"
+      - "traefik.docker.network=dev_lab"
 
   qdrant:
     image: qdrant/qdrant:latest