diff --git a/docker-compose.yml b/docker-compose.yml
index 9a1fc5d..a1f827f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,17 +3,25 @@ services:
     build: .
     container_name: card-grader
     restart: unless-stopped
-    # Bound to 127.0.0.1 deliberately: nginx (running on the Unraid host,
-    # or in its own container sharing the host network) is the only thing
-    # that should reach this port directly. Nothing on the LAN or internet
-    # can hit :8778 without going through nginx's TLS termination.
+    # Bound to all interfaces (not 127.0.0.1) because Nginx Proxy Manager
+    # runs in its own container on a separate macvlan IP (192.168.86.2),
+    # not in this host's network namespace — it has to reach this over the
+    # LAN at 192.168.86.33:8778, same as every other *arr-style service
+    # already proxied through this box. That also means anything else on
+    # the LAN can hit :8778 directly, bypassing the basic-auth NPM adds in
+    # front of hippofam.com/cards — consistent with how the rest of this
+    # box's services already work (LAN is the trust boundary here), but
+    # worth knowing.
     ports:
-      - "127.0.0.1:8778:8778"
+      - "8778:8778"
     volumes:
       - ./data:/data
     environment:
-      # Refuses settings writes from anyone but you, so a visitor can't
-      # overwrite your API key or switch to a pricier model. Set your key
-      # via the container's own console the first time (see README), then
-      # leave this on.
+      # Refuses settings writes from anyone but the host, so a visitor
+      # can't overwrite the API key or switch to a pricier model. Set to 0
+      # temporarily (on the live server only, not here) while setting the
+      # API key via the app's own Settings screen, then back to 1.
       - CARD_GRADER_LOCK=1
+      # This app is reverse-proxied at hippofam.com/cards, not the domain
+      # root — see app.py's BASE_PATH handling.
+      - CARD_GRADER_BASE_PATH=/cards