diff --git a/compose.yaml b/compose.yaml
index 2b1d272..5b7dbcf 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -31,9 +31,6 @@ services:
   gitea:
     container_name: tapm-gitea
     image: docker.gitea.com/gitea:1.26.4-rootless
-    env_file:
-      - path: .env
-        required: false
     restart: unless-stopped
     networks:
       - edge
@@ -45,6 +42,8 @@ services:
       GITEA__database__PATH: /var/lib/gitea/data/gitea.db
       GITEA__server__DOMAIN: ${GITEA_DOMAIN}
       GITEA__server__ROOT_URL: https://${GITEA_DOMAIN}/
+      GITEA__server__HTTP_ADDR: 0.0.0.0
+      GITEA__server__HTTP_PORT: "3000"
       GITEA__server__DISABLE_SSH: "true"
       GITEA__service__DISABLE_REGISTRATION: "true"
       GITEA__security__INSTALL_LOCK: "true"
diff --git a/docs/deployment.md b/docs/deployment.md
index 8fdf2f1..1b2f2b5 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -13,7 +13,9 @@ One Compose project manages:
 
 In production, only the configured Nginx HTTP and HTTPS ports are published.
 They default to 8680 and 8643. Inside Docker, Nginx listens on ports 80 and 443,
-the broker on 8080, and Gitea on 3000. Gitea SSH is disabled.
+the broker on 8080, and Gitea is explicitly pinned to `0.0.0.0:3000`. Gitea
+SSH is disabled. Deployment-level variables such as `HTTP_PORT` are not passed
+into the Gitea container, preventing them from overriding its internal listener.
 
 ## 1. VM and network