diff --git a/docker-compose.yml b/docker-compose.yml
index c300b76..95cfd0d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,20 +5,23 @@ services:
     restart: unless-stopped
     env_file: .env
     ports:
-      - "3457:3457"      # internal only; Traefik handles external
+      - "3457:3457"
     volumes:
-      - ./data:/app/data  # SQLite persistence
+      - ./data:/app/data
     networks:
       - dokploy-network
     labels:
-      # Traefik routing
       - "traefik.enable=true"
+      # HTTPS router
       - "traefik.http.routers.position-tracker.rule=Host(`angel.manohargupta.com`)"
       - "traefik.http.routers.position-tracker.entrypoints=websecure"
       - "traefik.http.routers.position-tracker.tls=true"
       - "traefik.http.routers.position-tracker.tls.certresolver=letsencrypt"
       - "traefik.http.services.position-tracker.loadbalancer.server.port=3457"
-      # Security headers middleware (reuse existing if defined, or inline)
+      # HTTP router — redirects to HTTPS using the existing redirect-to-https middleware
+      - "traefik.http.routers.position-tracker-http.rule=Host(`angel.manohargupta.com`)"
+      - "traefik.http.routers.position-tracker-http.entrypoints=web"
+      - "traefik.http.routers.position-tracker-http.middlewares=redirect-to-https@file"
 
 networks:
   dokploy-network: