diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 6c769b35..b785b002 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -27,9 +27,15 @@ RUN npm run build
 # ---- runner ----
 FROM node:20-alpine AS runner
 WORKDIR /app
+# Next.js standalone server.js binds to `process.env.HOSTNAME || '0.0.0.0'`.
+# Docker auto-sets HOSTNAME to the container id, so without this the server binds
+# that hostname and the compose healthcheck (TCP 127.0.0.1:3000) is refused →
+# container shows "(unhealthy)" although it serves fine via Caddy (service name).
+# Pin 0.0.0.0 so it listens on all interfaces and the healthcheck connects.
 ENV NODE_ENV=production \
     NEXT_TELEMETRY_DISABLED=1 \
-    PORT=3000
+    PORT=3000 \
+    HOSTNAME=0.0.0.0
 
 # `node` user (uid 1000) ships with the alpine image.
 COPY --from=builder --chown=node:node /app/public ./public