diff --git a/DEPLOY.md b/DEPLOY.md
index c4d9e70..692cf0d 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -46,19 +46,19 @@ In Dockge, **+ Compose** → name it `flashcard`, and paste the contents of
 `compose.yaml` from this repo (or copy the file into the stack directory). Then edit
 the `environment:` block:
 
-- `APP_URL` → how users reach the app, e.g. `http://10.0.10.205:4000`
+- `APP_URL` → how users reach the app, e.g. `http://10.0.10.205:4100`
   (used in verification / reset / invite e-mail links — get it right).
 - `COOKIE_SECURE` → leave `false` over plain HTTP; set `true` only behind HTTPS.
 - SMTP (Amazon SES) → fill in `SMTP_HOST` / `SMTP_USER` / `SMTP_PASS` / `SMTP_FROM`,
   **or** leave `SMTP_HOST` empty for the first boot (see Step 4).
 
-The stack maps host **4000 → container 4000** and persists the SQLite DB in the
+The stack maps host **4100 → container 4000** and persists the SQLite DB in the
 `flashcard-data` volume.
 
 ## Step 3 — deploy
 
 Click **Deploy**. Dockge pulls the image and starts it. Open
-`http://10.0.10.205:4000`. Migrations run automatically on container start.
+`http://10.0.10.205:4100`. Migrations run automatically on container start.
 
 ## Step 4 — create the first account (becomes sysadmin)
 
diff --git a/compose.yaml b/compose.yaml
index f205871..29742f6 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -4,16 +4,17 @@ services:
   flashcard:
     image: 10.0.10.205:3000/bert.hausmans/flashcards:latest
     container_name: flashcard
+    # host:container — host 4000 was taken by another stack, so expose on 4100.
     ports:
-      - 4000:4000
+      - 4100:4000
     environment:
       - NODE_ENV=production
       - PORT=4000
       - DB_PATH=/app/data/flashcard.db
 
       # URL where users reach the app. Used in verification / reset / invite emails.
-      # CHANGE THIS to your real address, e.g. http://10.0.10.205:4000
-      - APP_URL=http://CHANGE-ME:4000
+      # CHANGE THIS to your real address, e.g. http://10.0.10.205:4100
+      - APP_URL=http://CHANGE-ME:4100
 
       # Keep "false" over plain HTTP (otherwise the browser drops the login
       # cookie). Set "true" only once behind an HTTPS reverse proxy.