diff --git a/docker-compose.yml b/docker-compose.yml
index 622d0aa..514f424 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,11 +15,14 @@ services:
     # path on every restart.
     volumes:
       - reddit_bot_data:/app/data
-    # Ports are NOT published to the host. Dokploy/Traefik routes traffic
-    # to the container's internal ports via configured domains.
+    # Dashboard goes through Traefik on a domain; noVNC needs the WebSocket
+    # upgrade header, which the upstream openresty proxy strips, so we
+    # publish noVNC directly on a host port and access it via the dokploy
+    # host's IP. Auth is handled by VNC_PASSWORD.
+    ports:
+      - "16080:6080"   # noVNC, reachable as http://<dokploy-host>:16080/
     expose:
-      - "3000"   # Web dashboard
-      - "6080"   # noVNC for human login
+      - "3000"         # Web dashboard (Traefik-routed)
     environment:
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
       - REDDIT_USERNAME=${REDDIT_USERNAME}