diff --git a/nodes/heimdall/jobsquatch-alpha/compose.yaml b/nodes/heimdall/jobsquatch-alpha/compose.yaml
index 8025fed..bd62c65 100644
--- a/nodes/heimdall/jobsquatch-alpha/compose.yaml
+++ b/nodes/heimdall/jobsquatch-alpha/compose.yaml
@@ -64,22 +64,18 @@ services:
   frontend:
     image: ghcr.io/teamcastaldi/jobsquatch-frontend:${IMAGE_TAG:-latest}
     restart: unless-stopped
-    ports:
-      - "80:80"
     depends_on:
       app:
         condition: service_healthy
     labels:
-      # When a container is on multiple networks, Traefik picks one arbitrarily.
-      # Pin it to proxy-net so Traefik never tries to route via jobsquatch-internal.
+      traefik.enable: "true"
       traefik.docker.network: proxy-net
-        - "traefik.enable=true"
-        - "traefik.http.routers.jobsquatch.rule=Host(`jobsquatch-alpha.castaldifamily.com`)"
-        - "traefik.http.routers.jobsquatch.entrypoints=websecure"
-        - "traefik.http.routers.jobsquatch.tls=true"
-        - "traefik.http.routers.jobsquatch.tls.certresolver=cloudflare"
-        - "traefik.http.routers.jobsquatch.middlewares=security-headers@file"
-        - "traefik.http.services.jobsquatch.loadbalancer.server.port=80"
+      traefik.http.routers.jobsquatch.rule: "Host(`jobsquatch-alpha.castaldifamily.com`)"
+      traefik.http.routers.jobsquatch.entrypoints: websecure
+      traefik.http.routers.jobsquatch.tls: "true"
+      traefik.http.routers.jobsquatch.tls.certresolver: cloudflare
+      traefik.http.routers.jobsquatch.middlewares: security-headers@file
+      traefik.http.services.jobsquatch.loadbalancer.server.port: "80"
     networks:
       - jobsquatch-internal
       - proxy-net