diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 138dc5f..de99186 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -4,8 +4,6 @@ services:
     # Tag-Override per Umgebungsvariable: KOCHWAS_TAG=sha-abcd1234 docker compose pull
     image: gitea.siegeln.net/claude/kochwas:${KOCHWAS_TAG:-latest}
     pull_policy: always
-    ports:
-      - '3000:3000'
     volumes:
       - ./data:/data
     environment:
@@ -16,8 +14,22 @@ services:
     depends_on:
       - searxng
     restart: unless-stopped
+    networks:
+      - proxy
+      - internal
+    labels:
+      - "traefik.enable=true"
+      # Router for HTTPS traffic
+      - "traefik.http.routers.kochwas.rule=Host(`kochwas.siegeln.net`)"
+      - "traefik.http.routers.kochwas.entrypoints=websecure"
+      - "traefik.http.routers.kochwas.tls.certresolver=cloudflareResolver"
+      # Specify which port Traefik should forward traffic to inside the container
+      - "traefik.http.services.kochwas.loadbalancer.server.port=3000"
+      # Explicitly tell Traefik which network to use (since kochwas is on two networks)
+      - "traefik.docker.network=proxy"
 
   searxng:
+    # Absichtlich nur intern erreichbar — keine Traefik-Labels, kein externer Port.
     image: searxng/searxng:latest
     volumes:
       - ./searxng:/etc/searxng
@@ -25,3 +37,13 @@ services:
       - BASE_URL=http://searxng:8080/
       - INSTANCE_NAME=kochwas-search
     restart: unless-stopped
+    networks:
+      - internal
+
+networks:
+  proxy:
+    # Muss dem Namen des externen Traefik-Netzwerks entsprechen (ggf. in `name:` ändern).
+    external: true
+  internal:
+    # Eigenes internes Netz für kochwas ↔ searxng. Wird von Compose automatisch angelegt.
+    driver: bridge