diff --git a/.env.example b/.env.example
index a0e8521..0675da0 100644
--- a/.env.example
+++ b/.env.example
@@ -38,7 +38,8 @@ LOGDIR="/tmp/logs-$NAME/"
 NEXT_PUBLIC_REQUIRE_AUTH=false
 NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
 NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=your_supabase_anon_key_here
-NEXT_PUBLIC_API_BASE_URL=http://localhost:9812
+# Server-side proxy target (read by next.config.ts at runtime, not baked into the bundle)
+API_BASE_URL=http://localhost:9812
 
 # MinIO Object Storage (used instead of S3)
 MINIO_ROOT_USER=minioadmin
diff --git a/apps/webapp/next.config.ts b/apps/webapp/next.config.ts
index 740aeb0..e86565c 100644
--- a/apps/webapp/next.config.ts
+++ b/apps/webapp/next.config.ts
@@ -4,7 +4,9 @@ import path from "node:path";
 const nextConfig: NextConfig = {
   outputFileTracingRoot: path.join(process.cwd(), "../.."),
   async rewrites() {
-    const backend = process.env.API_BASE_URL ?? "http://localhost:9812";
+    // In Docker (Dokploy/compose) the backend container is always reachable at cvfs-backend:8080.
+    // Override with API_BASE_URL for local dev (e.g. http://localhost:9812).
+    const backend = process.env.API_BASE_URL ?? "http://cvfs-backend:8080";
     return [{ source: "/api/:path*", destination: `${backend}/api/:path*` }];
   },
 };