diff --git a/src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java b/src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java
index 8f06be8..e33cc33 100644
--- a/src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java
+++ b/src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java
@@ -126,6 +126,17 @@ public class DeploymentService {
                 });
             }
 
+            // Build Traefik labels for inbound routing
+            var labels = new java.util.HashMap<String, String>();
+            if (app.getExposedPort() != null) {
+                labels.put("traefik.enable", "true");
+                labels.put("traefik.http.routers." + containerName + ".rule",
+                        "Host(`" + app.getSlug() + "." + env.getSlug() + "."
+                                + tenantSlug + "." + runtimeConfig.getDomain() + "`)");
+                labels.put("traefik.http.services." + containerName + ".loadbalancer.server.port",
+                        String.valueOf(app.getExposedPort()));
+            }
+
             var containerId = runtimeOrchestrator.startContainer(new StartContainerRequest(
                     deployment.getImageRef(),
                     containerName,
@@ -141,7 +152,7 @@ public class DeploymentService {
                     runtimeConfig.parseMemoryLimitBytes(),
                     runtimeConfig.getContainerCpuShares(),
                     runtimeConfig.getAgentHealthPort(),
-                    Map.of()
+                    labels
             ));
 
             deployment.setOrchestratorMetadata(Map.of("containerId", containerId));