diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml
index dec1474b..9558ca02 100644
--- a/.github/workflows/release-docker.yml
+++ b/.github/workflows/release-docker.yml
@@ -63,13 +63,8 @@ jobs:
           target: production
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
-          # Bake a fixed public Reverb key; leave host/port/scheme empty so the
-          # frontend derives them from window.location (works on any domain).
           build-args: |
             VITE_REVERB_APP_KEY=trypost-reverb-key
-            VITE_REVERB_HOST=
-            VITE_REVERB_PORT=
-            VITE_REVERB_SCHEME=
           cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }}
           cache-to: type=gha,mode=max,scope=${{ env.PLATFORM_PAIR }}
           outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
diff --git a/compose.prod.yaml b/compose.prod.yaml
index c105ae72..d5bafaab 100644
--- a/compose.prod.yaml
+++ b/compose.prod.yaml
@@ -40,11 +40,11 @@ services:
       BROADCAST_CONNECTION: reverb
 
       # ===== WebSockets (Reverb) =====
-      # These are the INTERNAL server->Reverb connection — leave as-is even on a
-      # domain. The browser derives the WebSocket host from its own URL, and the
-      # in-container nginx proxies it on /app, so it just works on any domain.
+      # The published image bakes the client at localhost:8080. For a custom
+      # domain, rebuild the image with --build-arg VITE_REVERB_HOST=<domain>
+      # VITE_REVERB_PORT=443 VITE_REVERB_SCHEME=https.
       REVERB_APP_ID: "1001"
-      REVERB_APP_KEY: trypost-reverb-key           # matches the key baked into the published image
+      REVERB_APP_KEY: trypost-reverb-key           # must match the key baked into the published image
       REVERB_APP_SECRET: change-me-reverb-secret   # <- change me
       REVERB_HOST: localhost
       REVERB_PORT: "8080"
@@ -105,7 +105,8 @@ services:
       # ANTHROPIC_API_KEY: ""
       # GEMINI_API_KEY: ""
     ports:
-      - "8000:80"     # app (nginx); WebSocket rides this same port via /app
+      - "8000:80"     # app (nginx)
+      - "8080:8080"   # Reverb WebSocket
     volumes:
       - storage:/var/www/html/storage/app
     depends_on:
diff --git a/resources/js/echo.ts b/resources/js/echo.ts
index c378c0cd..9c5d42c7 100644
--- a/resources/js/echo.ts
+++ b/resources/js/echo.ts
@@ -1,15 +1,11 @@
 import { configureEcho } from '@laravel/echo-vue';
 
-const scheme = import.meta.env.VITE_REVERB_SCHEME || (window.location.protocol === 'https:' ? 'https' : 'http');
-const forceTLS = scheme === 'https';
-const port = Number(import.meta.env.VITE_REVERB_PORT || window.location.port || (forceTLS ? 443 : 80));
-
 configureEcho({
     broadcaster: 'reverb',
     key: import.meta.env.VITE_REVERB_APP_KEY,
-    wsHost: import.meta.env.VITE_REVERB_HOST || window.location.hostname,
-    wsPort: port,
-    wssPort: port,
-    forceTLS,
+    wsHost: import.meta.env.VITE_REVERB_HOST,
+    wsPort: import.meta.env.VITE_REVERB_PORT ?? 80,
+    wssPort: import.meta.env.VITE_REVERB_PORT ?? 443,
+    forceTLS: (import.meta.env.VITE_REVERB_SCHEME ?? 'https') === 'https',
     enabledTransports: ['ws', 'wss'],
 });