diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cd418995..dc3a78fa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -152,3 +152,11 @@ jobs:
       - name: Import Compiled Dependencies
         run: docker exec wvc /srv/webvirtcloud/venv/bin/python3 -c "import libvirt, ldap, lxml.etree, psycopg, sass"
 
+      # The browser reaches the console through nginx on the panel's port
+      - name: Console Through Nginx Only
+        run: |
+          [ "$(docker inspect -f '{{json .Config.ExposedPorts}}' webvirtcloud:ci)" = '{"80/tcp":{}}' ]
+          docker exec wvc grep -qx 'WS_PUBLIC_PORT = 80' /srv/webvirtcloud/webvirtcloud/settings.py
+          code=$(curl -s -m 5 -o /dev/null -w '%{http_code}' -H 'Connection: Upgrade' -H 'Upgrade: websocket' \
+            -H 'Sec-WebSocket-Version: 13' -H 'Sec-WebSocket-Key: dGVzdGtleXRlc3RrZXk9PQ==' http://127.0.0.1:8080/novncd/ || true)
+          [ "$code" = 101 ] || { echo "websocket upgrade through nginx: $code"; exit 1; }
diff --git a/Dockerfile b/Dockerfile
index 9d0f9876..612a3a91 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,7 +26,10 @@ RUN python3 -m venv venv \
 FROM phusion/baseimage:noble-1.0.2
 
 EXPOSE 80
-EXPOSE 6080
+
+# The browser reaches the console through nginx on the panel's port (the init
+# script writes this into settings.py); set it to the published port if not 80.
+ENV WS_PUBLIC_PORT=80
 
 # Use baseimage-docker's init system.
 CMD ["/sbin/my_init"]
diff --git a/README.md b/README.md
index 4334a83d..b98a2084 100644
--- a/README.md
+++ b/README.md
@@ -89,7 +89,7 @@ EOF
 docker compose up -d
 ```
 
-The panel is at `http://<server-ip>`, the noVNC console on port `6080`. The database and secret key live in the `webvirtcloud-data` volume, the SSH keys in `webvirtcloud-ssh`. Other settings go in the same `environment:` list, see [Environment variables](#environment-variables).
+The panel and its console are at `http://<server-ip>`. The database and secret key live in the `webvirtcloud-data` volume, the SSH keys in `webvirtcloud-ssh`. Other settings go in the same `environment:` list, see [Environment variables](#environment-variables).
 
 ### Manual installation
 
@@ -281,7 +281,7 @@ If libvirt warns `Host SMBIOS information is not available`, install `dmidecode`
 | `EMAIL_HOST`, `EMAIL_PORT`, `EMAIL_HOST_USER`, `EMAIL_HOST_PASSWORD`, `EMAIL_USE_TLS` | SMTP for e-mail OTP |
 | `WEBVIRTCLOUD_LOG_FILE` | log file (default `data/webvirtcloud.log`, rotated at 10 MB × 5) |
 | `SECRET_KEY` | Django secret key (default: the `data/secret_key` file) |
-| `WS_PUBLIC_PORT`, `WS_PUBLIC_HOST`, `WS_PUBLIC_PATH` | Docker only: public noVNC address |
+| `WS_PUBLIC_PORT`, `WS_PUBLIC_HOST`, `WS_PUBLIC_PATH` | Docker only: public console address; `WS_PUBLIC_PORT` must be the port the panel is published on (default 80) |
 
 Where to set them:
 
@@ -476,6 +476,7 @@ Older versions collected static files into `static/`; `git clean -n static/` lis
 - The admin's first-login password change survives losing `data/admin_password` (migration `accounts.0007`); run `migrate` as a user who can read that file.
 - "VM Clone Auto Migrate" is removed; a clone stays on its source host.
 - The log rotates (10 MB × 5) in `data/webvirtcloud.log`.
+- Docker no longer publishes port 6080; the console goes through nginx on the panel's port (`WS_PUBLIC_PORT`, default 80).
 
 ## Usage
 
diff --git a/docker-compose.yml b/docker-compose.yml
index f8db10ab..977529f8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,12 +8,14 @@ services:
     restart: unless-stopped
     ports:
       - "80:80"
-      - "6080:6080"
     environment:
       # Optional: custom Django secret key. If unset, automatically generated at first launch.
       # - SECRET_KEY=your-custom-secret-key-here
       # Optional: comma-separated trusted CSRF origins (e.g. http://wvc.example.com,https://wvc.example.com)
       # - CSRF_TRUSTED_ORIGINS=http://localhost,http://127.0.0.1
+      # The console goes through nginx on the panel's port: set this to the
+      # published port if it is not 80 (443 behind TLS)
+      # - WS_PUBLIC_PORT=443
       # Optional: PostgreSQL instead of the bundled sqlite (also WEBVIRTCLOUD_DB_PORT/_NAME/_USER)
       # - WEBVIRTCLOUD_DB_HOST=db.example.com
       # - WEBVIRTCLOUD_DB_PASSWORD=change-me