diff --git a/dankserver/copyparty/quadlet/copyparty.container b/dankserver/copyparty/quadlet/copyparty.container
index bdceca9..e187ec2 100644
--- a/dankserver/copyparty/quadlet/copyparty.container
+++ b/dankserver/copyparty/quadlet/copyparty.container
@@ -27,6 +27,7 @@ EnvironmentFile=/home/dank/Containers/copyparty/env
 Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
 Volume=/mnt/entropy:/w
 Volume=/home/dank/Containers/copyparty/cfg:/cfg
+PublishPort=3923:3923
 
 [Service]
 EnvironmentFile=/home/dank/Containers/copyparty/env
diff --git a/tests/dankserver_quadlet.bats b/tests/dankserver_quadlet.bats
index ac2afdb..952acbd 100755
--- a/tests/dankserver_quadlet.bats
+++ b/tests/dankserver_quadlet.bats
@@ -56,3 +56,10 @@ load helpers
     done
     grep -q '^AddDevice=/dev/dri$' "$REPO_ROOT/dankserver/jellyfin/quadlet/jellyfin.container" || return 1
 }
+
+@test "every host-served port is explicitly published (no silent bridge-only)" {
+    grep -q '^PublishPort=8085:8080$' "$REPO_ROOT/dankserver/romm/quadlet/romm.container" || return 1
+    grep -q '^PublishPort=8096:8096$' "$REPO_ROOT/dankserver/jellyfin/quadlet/jellyfin.container" || return 1
+    grep -q '^PublishPort=8083:8083$' "$REPO_ROOT/dankserver/calibre-web/quadlet/calibre-web.container" || return 1
+    grep -q '^PublishPort=3923:3923$' "$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1
+}