diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 1550a01..2fb62c0 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -77,6 +77,9 @@ services:
         -c checkpoint_completion_target=0.9
         -c wal_buffers=16MB
         -c random_page_cost=1.1
+    # No host port mapping — backend reaches postgres via the Docker network.
+    # Removes 2 docker-proxy processes and closes 0.0.0.0:5432 to the internet.
+    ports: []
     deploy:
       resources:
         limits:
@@ -86,4 +89,7 @@ services:
     restart: unless-stopped
 
   redis:
+    # No host port mapping — backend reaches redis via the Docker network.
+    # Removes 2 docker-proxy processes and closes 0.0.0.0:6379 to the internet.
+    ports: []
     restart: unless-stopped