diff --git a/docker-compose.yml b/docker-compose.yml
index 1ba3fa0..782fec9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,6 +12,14 @@ services:
       - backend
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   backend:
@@ -98,6 +106,14 @@ services:
         condition: service_healthy
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   # ── Celery workers ─────────────────────────────────────────────────────
@@ -163,6 +179,14 @@ services:
       start_period: 120s
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   # Dedicated watcher worker — runs the long-lived watch_folders task
@@ -197,6 +221,14 @@ services:
         condition: service_healthy
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   worker-vision:
@@ -263,6 +295,14 @@ services:
         condition: service_healthy
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   db:
@@ -276,6 +316,14 @@ services:
       - pg_data:/var/lib/postgresql/data
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U mulita -d mulita"]
@@ -294,6 +342,14 @@ services:
       - redis_data:/data
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
     command: redis-server --appendonly yes
     healthcheck: