diff --git a/.env.example b/.env.example
index 7764448..c4ff078 100644
--- a/.env.example
+++ b/.env.example
@@ -12,13 +12,13 @@ LOG_LEVEL=info
 # to ../web/dist relative to the running api bundle.
 # STATIC_DIR=
 
+# Host port exposed by the Portainer stack.
+GASHBOARD_PORT=1337
+
 # ---- Datum gateway (the Umbrel app we're polling) ----
-# Portainer on Umbrel runs stacks inside Docker-in-Docker with host networking.
-# Use Datum's real Umbrel Docker IP. Do not use datum/datum_datum_1 DNS and do
-# not use host port 21000, which is Umbrel's auth proxy.
-# Find it with:
-# docker inspect -f '{{.NetworkSettings.Networks.umbrel_main_network.IPAddress}}' datum_datum_1
-DATUM_URL=http://10.21.0.11:21000
+# The stack joins Umbrel's real Docker network, so use Datum's container name.
+# Do not hard-code Datum's container IP; it can change after reboot.
+DATUM_URL=http://datum_datum_1:21000
 DATUM_ADMIN_USER=admin
 DATUM_ADMIN_PASSWORD=
 # How often to scrape /clients (ms). Datum updates per-worker hashrate every
diff --git a/README.md b/README.md
index 1760fba..cd522ac 100644
--- a/README.md
+++ b/README.md
@@ -46,12 +46,12 @@ Allowlist of npubs is set via `NOSTR_ALLOWED_NPUBS`. Anything else is rejected b
    - Repository URL: `https://git.tx1138.com/lfg2025/gashboard`
    - Compose path: `docker-compose.yml`
    - Add env vars (see `.env.example`)
-   - Set `DATUM_NETWORK` to the network attached to `datum_datum_1`:
+   - The stack attaches to the Umbrel network attached to `datum_datum_1`:
      ```bash
      docker inspect -f '{{range $name, $_ := .NetworkSettings.Networks}}{{$name}}{{"\n"}}{{end}}' datum_datum_1
      ```
    - On Umbrel this is usually `umbrel_main_network`, which is the compose default.
-   - Leave `DATUM_URL` unset unless you need to override it. The default is `http://datum:21000`, which uses Datum's Compose service alias and avoids Umbrel's host proxy and stale container IPs.
+   - Leave `DATUM_URL` unset unless you need to override it. The default is `http://datum_datum_1:21000`, which uses Docker DNS and avoids Umbrel's host proxy and stale container IPs.
 
 4. Open the dashboard, log in with one of the allowed npubs, watch your boards lose at hashing in style.
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 9d93035..4c4ee26 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,10 +2,9 @@ version: "3.9"
 
 # gashboard — deploy as a Portainer Stack on the same Umbrel host that runs Datum.
 #
-# Umbrel's Portainer app runs user stacks inside Docker-in-Docker. A Portainer
-# stack network named "umbrel_main_network" is not the real Umbrel host network,
-# so Docker DNS names such as datum_datum_1 do not resolve from this container.
-# Host networking is used here so gashboard can reach Datum's real container IP.
+# Attach to Umbrel's real app network so Docker DNS can resolve Datum by
+# container name. This avoids hard-coding Datum's container IP, which can change
+# after reboot and cause ECONNREFUSED.
 
 services:
   gashboard:
@@ -25,11 +24,9 @@ services:
       PORT: "1337"
       LOG_LEVEL: "${LOG_LEVEL:-info}"
       CORS_ORIGIN: "${CORS_ORIGIN:-}"
-      # Reach the Datum gateway container directly. Do not use Umbrel's
-      # published port 21000 here; it is the Umbrel auth proxy.
-      # Find the current IP with:
-      # docker inspect -f '{{.NetworkSettings.Networks.umbrel_main_network.IPAddress}}' datum_datum_1
-      DATUM_URL: "${DATUM_URL?must be set, e.g. http://10.21.0.11:21000}"
+      # Reach the Datum gateway container directly over Umbrel's Docker network.
+      # Do not use a hard-coded container IP; it can change after reboot.
+      DATUM_URL: "${DATUM_URL:-http://datum_datum_1:21000}"
       DATUM_ADMIN_USER: "${DATUM_ADMIN_USER:-admin}"
       DATUM_ADMIN_PASSWORD: "${DATUM_ADMIN_PASSWORD?must be set}"
       DATUM_POLL_INTERVAL_MS: "${DATUM_POLL_INTERVAL_MS:-5000}"
@@ -37,10 +34,17 @@ services:
       NOSTR_ALLOWED_NPUBS: "${NOSTR_ALLOWED_NPUBS?must be set}"
       JWT_SECRET: "${JWT_SECRET?must be set}"
       JWT_TTL_SECONDS: "${JWT_TTL_SECONDS:-86400}"
-    network_mode: host
+    ports:
+      - "${GASHBOARD_PORT:-1337}:1337"
+    networks:
+      - umbrel_main_network
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:1337/healthz"]
       interval: 30s
       timeout: 5s
       retries: 3
       start_period: 15s
+
+networks:
+  umbrel_main_network:
+    external: true