diff --git a/docker-compose.yml b/docker-compose.yml
index 05ba97e31..642e623b9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -309,7 +309,8 @@ services:
       dockerfile: Dockerfile
       args:
         NEXT_PUBLIC_SITE_URL: ${SITE_URL:-https://myeasycms.de}
-        NEXT_PUBLIC_SUPABASE_URL: http://localhost:8000
+        # Browser-side Supabase URL — goes through external domain (Traefik → Kong)
+        NEXT_PUBLIC_SUPABASE_URL: ${API_EXTERNAL_URL:-http://localhost:8000}
         NEXT_PUBLIC_SUPABASE_PUBLIC_KEY: ${SUPABASE_ANON_KEY}
     restart: unless-stopped
     depends_on:
@@ -317,14 +318,11 @@ services:
         condition: service_healthy
       supabase-db-migrate:
         condition: service_completed_successfully
-    # App shares Kong's network namespace — localhost:8000 inside the container
-    # reaches Kong directly. This keeps the same URL for browser AND server,
-    # so Supabase cookie names match without any code changes.
-    network_mode: "service:supabase-kong"
     environment:
       NODE_ENV: production
       NEXT_PUBLIC_SITE_URL: ${SITE_URL:-http://localhost:3000}
-      NEXT_PUBLIC_SUPABASE_URL: http://localhost:8000
+      # Server-side Supabase URL — direct Docker network access to Kong
+      NEXT_PUBLIC_SUPABASE_URL: http://supabase-kong:8000
       NEXT_PUBLIC_SUPABASE_PUBLIC_KEY: ${SUPABASE_ANON_KEY}
       SUPABASE_SECRET_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
       SUPABASE_DB_WEBHOOK_SECRET: ${DB_WEBHOOK_SECRET:-webhooksecret}
diff --git a/docker/kong.yml b/docker/kong.yml
index b098b7e72..3c1732466 100644
--- a/docker/kong.yml
+++ b/docker/kong.yml
@@ -88,7 +88,7 @@ services:
 
   # Next.js App (catch-all — must be last so API routes take priority)
   - name: app
-    url: http://localhost:3000/
+    url: http://app:3000/
     routes:
       - name: app-routes
         strip_path: false