diff --git a/.env.example b/.env.example
index d523c9a..84d197c 100644
--- a/.env.example
+++ b/.env.example
@@ -3,3 +3,5 @@
 AW_REGISTRATION_CODE=
 # 1 when running behind a reverse proxy that sets X-Forwarded-For / X-Forwarded-Proto / X-Forwarded-Host:
 AW_TRUST_PROXY=0
+# Port on the host (bound to 127.0.0.1 only). nginx proxies to it. Pick a free one (check: ss -tlnp | grep :8090):
+AW_PORT=8090
diff --git a/DEPLOY.md b/DEPLOY.md
index 05ab456..21a1d41 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -48,10 +48,10 @@ cp .env.example .env
 nano .env            # set AW_REGISTRATION_CODE, and AW_TRUST_PROXY=1 (nginx is in front)
 chmod 600 .env
 docker compose up -d --build
-curl -sI http://127.0.0.1:8080 | head -1      # should print HTTP/1.1 200 OK
+curl -sI http://127.0.0.1:8090 | head -1      # should print HTTP/1.1 200 OK
 ```
 
-The container only listens on `127.0.0.1:8080`, so it is not reachable from outside until nginx forwards to it. The database is `./db/aw.db`.
+The container only listens on `127.0.0.1:8090` (change it with `AW_PORT` in `.env` if the port is taken, e.g. AMP uses 8080), so it is not reachable from outside until nginx forwards to it. The database is `./db/aw.db`.
 
 ## 4. nginx + HTTPS
 
@@ -65,7 +65,7 @@ server {
     client_max_body_size 1m;
 
     location / {
-        proxy_pass http://127.0.0.1:8080;
+        proxy_pass http://127.0.0.1:8090;   # same as AW_PORT in .env
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $remote_addr;   # overwrite, so clients cannot fake their address
         proxy_set_header X-Forwarded-Proto $scheme;
@@ -82,7 +82,7 @@ sudo certbot --nginx -d aw.yourdomain.tld          # gets the certificate, adds
 
 Then add inside the HTTPS `server` block: `add_header Strict-Transport-Security "max-age=31536000" always;`
 
-Firewall: only SSH, 80 and 443 should be open. Port 8080 is not published to the outside at all.
+Firewall: only SSH, 80 and 443 should be open. The app port (AW_PORT, default 8090) is not published to the outside at all.
 
 Open the site, choose "Create account" and register with your registration code.
 
diff --git a/README.md b/README.md
index 445c69d..cc8fd75 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ Website for creating characters for the Arcane Wasteland TTRPG, with a searchabl
 docker compose up -d --build
 ```
 
-Then open `http://localhost:8080` (the port is bound to the machine itself; see **DEPLOY.md** for running it on a server with its own user, nginx and HTTPS). Users, characters and presets are stored in `./db/aw.db`.
+Then open `http://localhost:8090` (the port is bound to the machine itself; see **DEPLOY.md** for running it on a server with its own user, nginx and HTTPS). Users, characters and presets are stored in `./db/aw.db`.
 
 ### Login and accounts
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 556a634..ead62ac 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,7 +5,7 @@ services:
     ports:
       # Only reachable from the server itself; the reverse proxy (nginx) is the public entrance.
       # Docker bypasses firewall rules for published ports, so never publish this on 0.0.0.0.
-      - "127.0.0.1:8080:8000"
+      - "127.0.0.1:${AW_PORT:-8090}:8000"
     security_opt:
       - no-new-privileges:true
     environment: