diff --git a/docker-compose.yml b/docker-compose.yml
index ec41733..d4bce6e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,8 +6,6 @@ services:
     image: mongo:7.0
     container_name: scoffer-mongodb
     restart: unless-stopped
-    ports:
-      - "${MONGODB_PORT:-27017}:27017"
     volumes:
       - mongodb_data:/data/db
       - ./backend/seedData.js:/docker-entrypoint-initdb.d/01-seedData.js:ro
@@ -35,7 +33,7 @@ services:
       - JWT_SECRET=${JWT_SECRET}
       - ALLOW_REGISTRATION=${ALLOW_REGISTRATION:-true}
     ports:
-      - "${BACKEND_PORT:-5000}:5000"
+      - "127.0.0.1:${BACKEND_PORT:-5000}:5000"
     depends_on:
       mongodb:
         condition: service_healthy
@@ -57,9 +55,16 @@ services:
     environment:
       - REACT_APP_API_URL=${REACT_APP_API_URL:-http://backend:5000/api}
     ports:
-      - "${FRONTEND_PORT:-3000}:80"
+      - "127.0.0.1:${FRONTEND_PORT:-3000}:80"
     depends_on:
       - backend
+    # nginx in the image listens on IPv4 only; "localhost" resolves to ::1
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:80/ || exit 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+      start_period: 5s
     networks:
       - recipe-network
 
@@ -69,7 +74,7 @@ services:
     container_name: scoffer-mongo-express
     restart: unless-stopped
     ports:
-      - "${MONGO_EXPRESS_PORT:-8081}:8081"
+      - "127.0.0.1:${MONGO_EXPRESS_PORT:-8081}:8081"
     environment:
       ME_CONFIG_MONGODB_URL: mongodb://mongodb:27017/
       ME_CONFIG_BASICAUTH: "false"