diff --git a/CLAUDE.md b/CLAUDE.md
index 188ba63..ba5e065 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -30,7 +30,7 @@ Frontend (`mykindlebox/client`):
 - `npm run build` — production build to `dist/`
 - `npm run lint` — ESLint
 
-Deployment: `docker compose up --build` from `mykindlebox/` serves the app on port 8080 (nginx serves the built client and reverse-proxies `/api` + `/uploads` to the Node server). Set `MYKINDLEBOX_PASSWORD` (e.g. in `mykindlebox/.env`) to require a login; if unset, auth is disabled.
+Deployment: `docker compose up --build` from `mykindlebox/` serves the app on port 8080 by default (nginx serves the built client and reverse-proxies `/api` + `/uploads` to the Node server). Configure via `mykindlebox/.env`: `MYKINDLEBOX_PORT` overrides the host port, and `MYKINDLEBOX_PASSWORD` requires a login (if unset, auth is disabled).
 
 ### Conventions
 
diff --git a/mykindlebox/README.md b/mykindlebox/README.md
index f122b2c..6235351 100644
--- a/mykindlebox/README.md
+++ b/mykindlebox/README.md
@@ -88,6 +88,17 @@ The app is served on **http://localhost:8080** — nginx serves the built client
 and reverse-proxies `/api` + `/uploads` to the Node server. The SQLite database
 and uploaded photos live in the `server-data` Docker volume.
 
+To serve on a different host port, set `MYKINDLEBOX_PORT` (e.g. in a `.env` file
+next to `docker-compose.yml`, alongside `MYKINDLEBOX_PASSWORD`):
+
+```env
+MYKINDLEBOX_PORT=3000
+```
+
+Then re-run `docker compose up -d` — the app is served on that port instead of
+8080. (Only the host side changes; inside the compose network nginx still
+listens on 80.)
+
 ### Authentication
 
 Auth is **optional** and off by default. To require a login, set
diff --git a/mykindlebox/docker-compose.yml b/mykindlebox/docker-compose.yml
index c0a0a48..22e6952 100644
--- a/mykindlebox/docker-compose.yml
+++ b/mykindlebox/docker-compose.yml
@@ -24,7 +24,9 @@ services:
   client:
     build: ./client
     ports:
-      - "8080:80"
+      # Host port is configurable: set MYKINDLEBOX_PORT (e.g. in the same .env
+      # as MYKINDLEBOX_PASSWORD) to serve on a different port. Defaults to 8080.
+      - "${MYKINDLEBOX_PORT:-8080}:80"
     # Wait for the API to answer /health before starting nginx, so the first
     # page load after `docker compose up` can't hit a 502 from a still-booting
     # server.