diff --git a/.env.example b/.env.example
index 492bb8a..50e7ab3 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,7 @@
 NODE_ENV=development
 PORT=4000
 PUBLIC_BASE_URL=http://localhost:4000
-WEB_ORIGIN=http://localhost:3000
+WEB_ORIGIN=http://localhost:3001
 NEXT_PUBLIC_AUTH_MODE=demo
 
 # --- Storage (MinIO via docker compose) -------------------------------------
diff --git a/apps/api/src/config.ts b/apps/api/src/config.ts
index 5c7b1f6..a3061b2 100644
--- a/apps/api/src/config.ts
+++ b/apps/api/src/config.ts
@@ -15,7 +15,7 @@ const schema = z.object({
   HOST: z.string().default("0.0.0.0"),
   PORT: numberFromEnv.default(4000),
   PUBLIC_BASE_URL: z.string().url().default("http://localhost:4000"),
-  WEB_ORIGIN: z.string().url().default("http://localhost:3000"),
+  WEB_ORIGIN: z.string().url().default("http://localhost:3001"),
   DATABASE_URL: z.string().optional(),
   STORAGE_MODE: z.enum(["local", "s3"]).default("local"),
   LOCAL_STORAGE_DIR: z.string().default(".data/storage"),
diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index ad6b56a..e25f881 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -78,7 +78,7 @@ export async function createServer() {
   // them in memory, so a 5 GiB ADP doesn't exhaust the process.
   app.addContentTypeParser(["application/zip", "application/octet-stream"], (_request, payload, done) => done(null, payload));
   await app.register(cookie);
-  // The control plane (web :3000) and API (:4000) are cross-origin, so allow
+  // The control plane (web :3001) and API (:4000) are cross-origin, so allow
   // the write methods the dashboard uses; @fastify/cors otherwise defaults to
   // GET/HEAD/POST and blocks PATCH/PUT in the browser.
   await app.register(cors, { origin: true, credentials: true, methods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"] });
diff --git a/docker-compose.yml b/docker-compose.yml
index dd207d6..57bc2fd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -77,7 +77,7 @@ services:
       AUTH_MODE: ${AUTH_MODE:-demo}
       PROCESS_INLINE: "false"
       PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:4000}
-      WEB_ORIGIN: ${WEB_ORIGIN:-http://localhost:3000}
+      WEB_ORIGIN: ${WEB_ORIGIN:-http://localhost:3001}
     ports:
       - "4000:4000"
     depends_on:
@@ -108,14 +108,13 @@ services:
 
   web:
     <<: *altdock-app
-    # vinext uses --hostname (not vite's --host) to bind the dev server.
-    command: npm run dev -- --hostname 0.0.0.0
+    # vinext uses --hostname/--port (not vite's --host) to bind the dev server.
+    command: npm run dev -- --hostname 0.0.0.0 --port 3001
     environment:
-      HOST: 0.0.0.0
       NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL:-http://localhost:4000}
       NEXT_PUBLIC_AUTH_MODE: ${AUTH_MODE:-demo}
     ports:
-      - "3000:3000"
+      - "3001:3001"
     depends_on:
       api:
         condition: service_started