diff --git a/.env.example b/.env.example
index 436acbf..e732614 100644
--- a/.env.example
+++ b/.env.example
@@ -25,6 +25,8 @@ AUTHENTIK_CLIENT_SECRET=your-client-secret
 TRAEFIK_NETWORK=traefik
 TRAEFIK_ENTRYPOINT=websecure
 TRAEFIK_CERT_RESOLVER=letsencrypt
+TRAEFIK_DASHBOARD_SUBDOMAIN=traefik
+TRAEFIK_LOG_LEVEL=INFO
 TOOL_SUBDOMAIN_PATTERN={tool}-{project}-{user}.tools.localhost
 
 # Frontend build-time variables (passed to web container)
diff --git a/deploy/.env.example b/deploy/.env.example
index c729bcb..504fd01 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -24,6 +24,7 @@ TRAEFIK_NETWORK=traefik
 TRAEFIK_LOG_LEVEL=INFO
 TRAEFIK_ENTRYPOINT=websecure
 TRAEFIK_CERT_RESOLVER=letsencrypt
+TRAEFIK_DASHBOARD_SUBDOMAIN=traefik
 API_TAG=latest
 WEB_TAG=latest
 REGISTRY=ghcr.io
diff --git a/deploy/portainer-stack.yml b/deploy/portainer-stack.yml
index dbe2743..488602d 100644
--- a/deploy/portainer-stack.yml
+++ b/deploy/portainer-stack.yml
@@ -29,9 +29,9 @@ services:
       - tools
     labels:
       - traefik.enable=true
-      - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN}`)
-      - traefik.http.routers.traefik-dashboard.entrypoints=websecure
-      - traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_SUBDOMAIN:-traefik}.${ROOT_DOMAIN}`)
+      - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
+      - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.routers.traefik-dashboard.service=api@internal
       - traefik.http.routers.traefik-dashboard.middlewares=auth@file
     restart: unless-stopped
@@ -43,12 +43,18 @@ services:
 
   api:
     image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/api:${API_TAG:-latest}
-    env_file:
-      - stack.env
     environment:
       - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
       - ROOT_DOMAIN=${ROOT_DOMAIN}
+      - TOOL_DOMAIN=${TOOL_DOMAIN}
+      - API_URL=${API_URL}
+      - WEB_URL=${WEB_URL}
       - CORS_ORIGINS=https://${ROOT_DOMAIN},https://*.${ROOT_DOMAIN}
+      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
+      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
+      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}
+      - ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES}
     depends_on:
       db:
         condition: service_healthy
@@ -60,7 +66,7 @@ services:
       - traefik.enable=true
       - traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN}`)
       - traefik.http.routers.api.entrypoints=websecure
-      - traefik.http.routers.api.tls.certresolver=letsencrypt
+      - traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.api.loadbalancer.server.port=8000
       - traefik.http.routers.api.middlewares=sec-headers@file
     restart: unless-stopped
@@ -73,8 +79,10 @@ services:
 
   web:
     image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/web:${WEB_TAG:-latest}
-    env_file:
-      - stack.env
+    environment:
+      - VITE_API_URL=${VITE_API_URL}
+      - VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER}
+      - VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID}
     depends_on:
       - api
     networks:
@@ -83,7 +91,7 @@ services:
       - traefik.enable=true
       - traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN}`)
       - traefik.http.routers.web.entrypoints=websecure
-      - traefik.http.routers.web.tls.certresolver=letsencrypt
+      - traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.web.loadbalancer.server.port=8080
       - traefik.http.routers.web.middlewares=sec-headers@file
     restart: unless-stopped
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index c240ddb..65a0d52 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -25,9 +25,9 @@ services:
       - tools
     labels:
       - traefik.enable=true
-      - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN:-localhost}`)
-      - traefik.http.routers.traefik-dashboard.entrypoints=websecure
-      - traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_SUBDOMAIN:-traefik}.${ROOT_DOMAIN:-localhost}`)
+      - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
+      - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.routers.traefik-dashboard.service=api@internal
       - traefik.http.routers.traefik-dashboard.middlewares=auth@file
     restart: unless-stopped
@@ -64,7 +64,7 @@ services:
       - traefik.enable=true
       - traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN:-localhost}`)
       - traefik.http.routers.api.entrypoints=websecure
-      - traefik.http.routers.api.tls.certresolver=letsencrypt
+      - traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.api.loadbalancer.server.port=8000
       - traefik.http.routers.api.middlewares=sec-headers@file
     restart: unless-stopped
@@ -91,7 +91,7 @@ services:
       - traefik.enable=true
       - traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN:-localhost}`)
       - traefik.http.routers.web.entrypoints=websecure
-      - traefik.http.routers.web.tls.certresolver=letsencrypt
+      - traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.web.loadbalancer.server.port=8080
       - traefik.http.routers.web.middlewares=sec-headers@file
     restart: unless-stopped