diff --git a/.env.example b/.env.example
index 3ab6bb4..aa25891 100644
--- a/.env.example
+++ b/.env.example
@@ -10,8 +10,8 @@ DOMAIN=devices.example.com
 # Public hostname clients use for the websocket tunnel.
 TUNNEL_DOMAIN=tunnel.example.com
 
-# Public hostname for the management API.
-MGMT_DOMAIN=mgmt.devices.example.com
+# Loopback-only host port for the management API.
+MGMT_PORT=6468
 
 # Shared JWT secret for relay and management. Use at least 16 random chars.
 SECRET=change-me-to-a-long-random-secret
diff --git a/docker-compose.yml b/docker-compose.yml
index 53757ab..62cdc9b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,7 +14,6 @@ services:
       SECRET: ${SECRET:?set SECRET in .env}
       API_HOSTNAME: ${TUNNEL_DOMAIN:?set TUNNEL_DOMAIN in .env}
       LISTEN: :8085
-      LOCALS: https:${MGMT_DOMAIN:?set MGMT_DOMAIN in .env}:6468
       AUTH_URL: http://mgmt:6468/api
       ACME_RELAY_URL: http://mgmt:6468/api/acme-relay
       VERBOSE: ${VERBOSE:-true}
@@ -36,8 +35,8 @@ services:
       TUNNEL_DOMAIN: ${TUNNEL_DOMAIN:?set TUNNEL_DOMAIN in .env}
       DB_URL: postgres://postgres:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/postgres?sslmode=disable
       LISTEN: 0.0.0.0:6468
-    expose:
-      - "6468"
+    ports:
+      - "127.0.0.1:${MGMT_PORT:-6468}:6468"
 
   postgres:
     image: postgres:16-alpine