diff --git a/docker-compose.yml b/docker-compose.yml
index 049a5ed..c2e5f0a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,7 +28,9 @@ services:
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
-      - "${GITEA_HTTP_PORT}:3000"
+      # Web is loopback-only: nginx (repos.guschin.info) is the only consumer.
+      # Was 0.0.0.0 — exposed Gitea directly; exploited for a miner in Sep 2026.
+      - "127.0.0.1:${GITEA_HTTP_PORT}:3000"
       - "${GITEA_SSH_PORT}:22"
     extra_hosts:
       - "host.docker.internal:host-gateway"