diff --git a/.env.example b/.env.example
index 7a9262b..e43fe22 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,9 @@
 NODE_ENV=development
 PORT=3001
 DATABASE_URL=./data/tech-library.db
-WEB_ORIGIN=http://localhost:5173
+# Docker Compose host binding. Change both values when using another port.
+HOST_PORT=8144
+WEB_ORIGIN=http://localhost:8144
 ADMIN_USERNAME=admin
 # Generate with: npm run password:hash -w @tech-library/api -- "your password"
 ADMIN_PASSWORD_HASH=
diff --git a/README.md b/README.md
index cc3c08c..4b8db34 100644
--- a/README.md
+++ b/README.md
@@ -37,6 +37,8 @@ Open `http://localhost:5173`. The API runs on port 3001. Local content is stored
 | `npm run db:seed` | Add the curated starter catalog |
 | `docker compose up -d --build` | Build and run the production topology |
 
+The Compose stack listens on host port `8144` by default. Copy `.env.example` to `.env` and change `HOST_PORT` plus `WEB_ORIGIN` when another port or public origin is required.
+
 ## Repository structure
 
 ```text
diff --git a/docker-compose.yml b/docker-compose.yml
index 5082fc4..7637def 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,7 +4,7 @@ services:
       context: .
       target: web
     ports:
-      - "8080:80"
+      - "${HOST_PORT:-8144}:80"
     depends_on:
       api:
         condition: service_healthy
@@ -18,7 +18,7 @@ services:
       NODE_ENV: production
       PORT: 3001
       DATABASE_URL: /data/tech-library.db
-      WEB_ORIGIN: ${WEB_ORIGIN:-http://localhost:8080}
+      WEB_ORIGIN: ${WEB_ORIGIN:-http://localhost:8144}
       ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
       ADMIN_PASSWORD_HASH: ${ADMIN_PASSWORD_HASH:?Set ADMIN_PASSWORD_HASH}
       SESSION_SECRET: ${SESSION_SECRET:?Set SESSION_SECRET}
diff --git a/docs/operations.md b/docs/operations.md
index 2282ba4..5f8668a 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -3,11 +3,11 @@
 ## Deployment
 
 1. Generate an Argon2id hash with `npm run password:hash -w @tech-library/api -- "a strong password"`.
-2. Copy `.env.example` to `.env`, set the hash, a random 32+ character session secret, and the public `WEB_ORIGIN`.
+2. Copy `.env.example` to `.env`, set the hash, a random 32+ character session secret, `HOST_PORT` (default `8144`), and the matching public `WEB_ORIGIN`.
 3. Run `docker compose up -d --build`.
-4. Verify `http://host:8080/healthz` and the API health check through Docker Compose.
+4. Verify `http://host:8144/healthz` (or the configured `HOST_PORT`) and the API health check through Docker Compose.
 
-Terminate TLS at a trusted reverse proxy and forward HTTPS to port 8080. Restrict filesystem access to the Docker volume and secrets file.
+Terminate TLS at a trusted reverse proxy and forward HTTPS to the configured host port. Restrict filesystem access to the Docker volume and secrets file.
 
 ## Backup and restore