diff --git a/.env.example b/.env.example
index 39359b6..eb11990 100644
--- a/.env.example
+++ b/.env.example
@@ -8,3 +8,5 @@ COOKIE_SECURE=false
 # address the app listens on. 127.0.0.1 = this machine only.
 # Reverse proxy on another machine (e.g. over Tailscale)? use this host's tailscale IP (tailscale ip -4)
 BIND_ADDR=127.0.0.1
+# port exposed on the host (the container itself always listens on 8000)
+HOST_PORT=8888
diff --git a/docker-compose.yml b/docker-compose.yml
index f91809d..a45a56c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,6 +21,6 @@ services:
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
       SECRET_KEY: ${SECRET_KEY}
       COOKIE_SECURE: ${COOKIE_SECURE:-false}
-    ports: ["${BIND_ADDR:-127.0.0.1}:8000:8000"]   # set BIND_ADDR to this host's Tailscale IP; never 0.0.0.0
+    ports: ["${BIND_ADDR:-127.0.0.1}:${HOST_PORT:-8888}:8000"]   # BIND_ADDR: this host's Tailscale IP, never 0.0.0.0. HOST_PORT: port on the host
 volumes:
   pgdata: