diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index c741b49..5169f55 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -165,7 +165,7 @@ jobs:
             # via cd-infra) are live. Idempotent.
             docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile || true
 
-            docker compose -f docker-compose.staging.yml -p trails-staging ps
+            docker compose -f docker-compose.staging.yml -p trails-staging --env-file staging.env --profile persistent ps
 
   # ── PR preview deploy ────────────────────────────────────────────────
   deploy-preview:
@@ -303,7 +303,7 @@ jobs:
             # Reload Caddy to pick up the per-PR snippet (writes/replaces it from the SCP step)
             docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile
 
-            docker compose -f docker-compose.staging.yml -p "$PROJECT" ps
+            docker compose -f docker-compose.staging.yml -p "$PROJECT" --env-file staging.env ps
 
       - name: Comment preview URL on PR
         uses: peter-evans/create-or-update-comment@v4
diff --git a/infrastructure/docker-compose.staging.yml b/infrastructure/docker-compose.staging.yml
index 1f91537..3b1d60d 100644
--- a/infrastructure/docker-compose.staging.yml
+++ b/infrastructure/docker-compose.staging.yml
@@ -31,8 +31,13 @@ services:
   journal:
     image: ghcr.io/trails-cool/journal:${JOURNAL_IMAGE_TAG:-latest}
     restart: unless-stopped
+    # Published on 0.0.0.0 (not 127.0.0.1) so the production Caddy container
+    # can reach it via host.docker.internal — Docker's host-gateway resolves
+    # to the bridge IP, not loopback. The Hetzner Cloud firewall blocks all
+    # inbound on ports 3000+ from the public internet, so this is effectively
+    # internal-only despite the bind address.
     ports:
-      - "127.0.0.1:${JOURNAL_HOST_PORT:?JOURNAL_HOST_PORT must be set}:3000"
+      - "${JOURNAL_HOST_PORT:?JOURNAL_HOST_PORT must be set}:3000"
     networks:
       - trails-shared
     environment:
@@ -72,8 +77,9 @@ services:
     # planner.staging.trails.cool. Saves ~256MB per active preview.
     profiles: ["persistent"]
     restart: unless-stopped
+    # Same rationale as the journal port — see the comment there.
     ports:
-      - "127.0.0.1:${PLANNER_HOST_PORT:-3101}:3001"
+      - "${PLANNER_HOST_PORT:-3101}:3001"
     networks:
       - trails-shared
     environment: