diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 3d46d08..5494d03 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -284,7 +284,7 @@ http://:8017 {
 
 	@hermes host hermes.franksdank.cloud
 	handle @hermes {
-		reverse_proxy hermes:8090
+		reverse_proxy 192.168.0.143:9119
 	}
 
 	@prometheus host prometheus.franksdank.cloud
diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml
index 77e19c5..14d065c 100644
--- a/dankclaw/compose.yaml
+++ b/dankclaw/compose.yaml
@@ -62,10 +62,11 @@ services:
       HERMES_DATA_DIR: /data
       # Point hermes's config/.env at the mounted data dir (persistent).
       HERMES_HOME: /data
-      # Signal adapter -> the host signal-cli daemon. The slirp host alias
-      # (host.containers.internal) can drop at runtime; the host LAN IP is the
-      # stable container->host path. 127.0.0.1 inside the container is not the host.
-      SIGNAL_HTTP_URL: "http://192.168.0.143:8080"
+      # Signal adapter -> the host signal-cli daemon (:8080, host process).
+      # From container space the host LAN IP only accepts connections to
+      # published ports (netavark DNAT); un-forwarded host ports refuse
+      # instantly. The gateway alias is the verified working path (2026-08-30).
+      SIGNAL_HTTP_URL: "http://host.containers.internal:8080"
       SIGNAL_ACCOUNT: "${SIGNAL_ACCOUNT}"
       SIGNAL_ALLOWED_USERS: "${SIGNAL_ALLOWED_USERS}"
     ports: