diff --git a/.env.example b/.env.example
index 2045753..8c88b33 100644
--- a/.env.example
+++ b/.env.example
@@ -4,6 +4,9 @@ APP_KEY=
 APP_DEBUG=true
 APP_URL=http://localhost:8000
 
+# Host port the app is published on (self-hosting only).
+APP_PORT=8000
+
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
 APP_FAKER_LOCALE=en_US
diff --git a/README.md b/README.md
index 9e18423..3beb576 100644
--- a/README.md
+++ b/README.md
@@ -53,6 +53,7 @@ ### Configuration
 | `DB_PASSWORD` | Database password |
 | `DB_ROOT_PASSWORD` | MariaDB root password |
 
+`APP_PORT` moves the published port (default `8000`) — set `APP_URL` to match if you change it.
 `DB_DATABASE` and `DB_USERNAME` both default to `anagram`. Anything else you might want to
 override is listed in [`.env.example`](.env.example).
 
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 1085719..b03662f 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -12,7 +12,10 @@
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        //
+        // The container is always behind a reverse proxy that terminates TLS;
+        // without this Laravel sees plain HTTP and generates http:// redirects
+        // onto an https:// page.
+        $middleware->trustProxies(at: '*');
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         $exceptions->shouldRenderJsonWhen(
diff --git a/compose.yaml b/compose.yaml
index 52e6f8b..0be59ea 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -12,7 +12,7 @@ services:
     container_name: anagram_app
     restart: unless-stopped
     ports:
-      - "127.0.0.1:8000:8000"
+      - "127.0.0.1:${APP_PORT:-8000}:8000"
     environment:
       APP_NAME: "Anagram Finder"
       APP_ENV: production