diff --git a/archivebox/tests/test_server_security_browser.py b/archivebox/tests/test_server_security_browser.py
index f23ee591..7113bbb2 100644
--- a/archivebox/tests/test_server_security_browser.py
+++ b/archivebox/tests/test_server_security_browser.py
@@ -724,6 +724,7 @@ def test_unconfigured_public_host_superuser_can_reach_setup_wizard(tmp_path: Pat
     archivebox_environment = compose["services"]["archivebox"]["environment"]
     assert "BASE_URL" in archivebox_environment
     assert "SERVER_SECURITY_MODE" in archivebox_environment
+    assert compose["services"]["archivebox"]["ports"] == ["${ARCHIVEBOX_PORT:-8000}:8000"]
     assert "--entrypoints.websecure.http.tls=true" in compose["services"]["traefik"]["entrypoint"][-1]
 
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 442f24cb..cf04decf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,7 +16,7 @@ services:
     archivebox:
         image: ${ARCHIVEBOX_IMAGE:-archivebox/archivebox:dev}
         ports:
-            - 8000:8000
+            - "${ARCHIVEBOX_PORT:-8000}:8000"
         volumes:
             - ./data:/data
             # Override abx-dl's nested VOLUME so profiles persist across containers.
@@ -82,6 +82,7 @@ services:
     # .env file next to this one, then `docker compose up -d`). Both want:
     #     BASE_URL=https://archive.example.com
     #     SERVER_SECURITY_MODE=safe-subdomains-fullreplay
+    #     ARCHIVEBOX_PORT=127.0.0.1:8000   # keep direct HTTP local; expose only the ingress publicly
 
     ### Option A — Cloudflare Tunnel (no public IP / behind NAT, e.g. home/NAS).
     # Cloudflare's edge terminates TLS and resolves *.your.domain to a SINGLE tunnel;
diff --git a/docs/Docker.md b/docs/Docker.md
index 967804e5..c3976602 100644
--- a/docs/Docker.md
+++ b/docs/Docker.md
@@ -178,7 +178,7 @@ If you want to access your archive server with HTTPS, the bundled `docker-compos
 - `COMPOSE_PROFILES=https` runs Traefik in front of ArchiveBox for HTTPS/TLS, with optional wildcard certificates via DNS-01.
 - `COMPOSE_PROFILES=tunnel` runs a Cloudflare Tunnel for deployments without a public IP.
 
-Set `BASE_URL=https://archive.example.com` in the `.env` file next to `docker-compose.yml`, then follow the inline comments in the compose file for the profile you choose. You can still bring your own reverse proxy such as Nginx or Caddy in front of `http://127.0.0.1:8000`; [`etc/nginx.conf`](https://github.com/ArchiveBox/ArchiveBox/blob/dev/etc/nginx.conf) remains a standalone example.
+Set `BASE_URL=https://archive.example.com` and `ARCHIVEBOX_PORT=127.0.0.1:8000` in the `.env` file next to `docker-compose.yml`, then follow the inline comments in the compose file for the profile you choose. The localhost port binding prevents direct HTTP access from bypassing the public HTTPS ingress. You can still bring your own reverse proxy such as Nginx or Caddy in front of `http://127.0.0.1:8000`; [`etc/nginx.conf`](https://github.com/ArchiveBox/ArchiveBox/blob/dev/etc/nginx.conf) remains a standalone example.
 
 <br/>