diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index bc64563..7f5237d 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -56,15 +56,21 @@ services:
       # be revoked from Paramètres → Appareils. The image URL is an unguessable
       # content hash.
       #
-      # The priority beats the entrypoint-wide HTTP→HTTPS redirection, which is
-      # otherwise applied to everything on :80. Remove this block the day the
-      # firmware learns the new roots, and set DEVICE_ALLOW_HTTP=false — the
-      # application refuses plain requests without it.
+      # It listens on its own entrypoint rather than on :80. Traefik applies an
+      # entrypoint's HTTP→HTTPS redirection before routing, so no router
+      # priority can escape it — the port has to be one that never redirects.
+      # That also makes the restriction structural: nothing but these four
+      # paths is reachable on 2300, and it is Traefik that guarantees it rather
+      # than application code.
+      #
+      # Requires the matching `device` entrypoint in the shared traefik.yml.
+      # Remove this block the day the firmware learns the new roots, and set
+      # DEVICE_ALLOW_HTTP=false — the application refuses plain requests
+      # without it.
       traefik.http.routers.horaires-device.rule: >-
         Host(`${APP_DOMAIN}`) && (PathPrefix(`/api/setup`) || PathPrefix(`/api/display`)
         || PathPrefix(`/api/log`) || PathPrefix(`/api/device/`))
-      traefik.http.routers.horaires-device.entrypoints: web
-      traefik.http.routers.horaires-device.priority: "2147483647"
+      traefik.http.routers.horaires-device.entrypoints: device
       traefik.http.routers.horaires-device.service: horaires
 
   backup: