diff --git a/docker-compose.yml b/docker-compose.yml
index 957ffe1..e549f7a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -35,19 +35,19 @@ services:
       - uploads:/app/uploads
       - thumbnails:/app/thumbnails
       - glb:/app/glb
-    # No host port published — Traefik reaches the app over the shared network
-    # at http://printhive-app:3000 (configure that in your Traefik file provider).
+    # No host port published — Traefik auto-discovers the app on the shared network.
     networks:
       - default     # talk to the db
       - traefik     # reachable by Traefik
     restart: unless-stopped
-    # Traefik (if using labels rather than your file provider):
-    # labels:
-    #   - "traefik.enable=true"
-    #   - "traefik.http.routers.printhive.rule=Host(`printhive.plexultra.com`)"
-    #   - "traefik.http.routers.printhive.entrypoints=websecure"
-    #   - "traefik.http.routers.printhive.tls.certresolver=letsencrypt"
-    #   - "traefik.http.services.printhive.loadbalancer.server.port=3000"
+    labels:
+      - "traefik.enable=true"
+      # App is on two networks; tell Traefik which one to reach it on.
+      - "traefik.docker.network=${TRAEFIK_NETWORK:-traefik}"
+      - "traefik.http.routers.printhive.rule=Host(`${PRINTHIVE_HOST:-printhive.plexultra.com}`)"
+      - "traefik.http.routers.printhive.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
+      - "traefik.http.routers.printhive.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}"
+      - "traefik.http.services.printhive.loadbalancer.server.port=3000"
 
 volumes:
   pgdata: