diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 8692c9a..d6e029c 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -5,8 +5,8 @@
 #   main / develop  →  SPRING_PROFILES_ACTIVE=prod   COMPOSE_PROFILES=with-db
 #   PR preview      →  SPRING_PROFILES_ACTIVE=dev    COMPOSE_PROFILES=       (H2, no DB)
 #
-# Coolify reads SERVICE_FQDN_FRONTEND_80 and auto-injects Traefik labels.
-# Set the FQDN for each app in the Coolify UI — no manual labels needed.
+# Coolify proxy=NONE → we manually expose through the forge's Traefik
+# (network: proxy, certresolver: letsencrypt).
 # ──────────────────────────────────────────────────────
 
 services:
@@ -20,9 +20,18 @@ services:
     depends_on:
       backend:
         condition: service_healthy
+    networks:
+      - default
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.citygame.rule=Host(`citygame.pele.cam`)"
+      - "traefik.http.routers.citygame.entrypoints=https"
+      - "traefik.http.routers.citygame.tls=true"
+      - "traefik.http.routers.citygame.tls.certresolver=letsencrypt"
+      - "traefik.http.services.citygame.loadbalancer.server.port=80"
+      - "traefik.docker.network=proxy"
     environment:
-      # Coolify replaces this value with the configured FQDN and injects
-      # the corresponding Traefik routing labels automatically.
       - SERVICE_FQDN_FRONTEND_80
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:80/healthz || exit 1"]
@@ -81,3 +90,7 @@ services:
 volumes:
   pgdata:
     driver: local
+
+networks:
+  proxy:
+    external: true