diff --git a/compose/langfuse-compose.yml b/compose/langfuse-compose.yml
index 3c4c297..44e3090 100644
--- a/compose/langfuse-compose.yml
+++ b/compose/langfuse-compose.yml
@@ -47,11 +47,23 @@ services:
     environment:
       NEXTAUTH_URL: https://lf.yokogawa.tech
       TELEMETRY_ENABLED: "false"
-      # Authelia already gates this at the edge - no second sign-up flow wanted.
-      AUTH_DISABLE_SIGNUP: "true"
+      # Langfuse is a Next.js standalone server: it binds to whatever $HOSTNAME
+      # resolves to, NOT to all interfaces. This container is on two networks, and
+      # the container hostname resolves to its PROXY address - so without this it
+      # listens on proxy only and is unreachable from ai-internal, where ai-api
+      # will run. Verified on the host: proxy HTTP 200, ai-internal HTTP 000.
+      # Binding 0.0.0.0 makes it listen on both, and on loopback.
+      HOSTNAME: "0.0.0.0"
+      # Langfuse keeps its own user table behind Authelia. Signup is left OPEN so
+      # anyone who has already cleared AD + Duo can create their own account -
+      # with it closed and no user seeded, nobody can log in at all. Accepted
+      # for the PoC because Authelia is the real gate. Revisit before handover.
+      AUTH_DISABLE_SIGNUP: "false"
       # DATABASE_URL, NEXTAUTH_SECRET and SALT come from langfuse.env.
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api/public/health || exit 1"]
+      # Works because HOSTNAME=0.0.0.0 above makes it bind all interfaces including
+      # loopback. Without that env var this probe fails while the app serves fine.
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/api/public/health || exit 1"]
       interval: 30s
       timeout: 5s
       retries: 3
@@ -60,7 +72,13 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
 networks:
+  # Created by ai-compose.yml, which runs under the shared 'azureuser' project,
+  # so Compose named it azureuser_ai-internal. Without the name: line the lookup
+  # is for a network literally called 'ai-internal' and up fails with
+  # "network ai-internal declared as external, but could not be found".
   ai-internal:
     external: true
+    name: azureuser_ai-internal
+  # proxy was created by hand, not by Compose, so it carries no project prefix.
   proxy:
     external: true