diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 9444cf8..f27f172 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -21,8 +21,12 @@ services:
       BROWSER_WS_URL: ${BROWSER_WS_URL:-ws://headless-shell:9222}
     depends_on:
       - headless-shell
+    # `networks:` here replaces the base file's list entirely, so both must be
+    # named: `proxy` for Traefik routing, `browser` (defined in the base file)
+    # to keep reaching headless-shell without putting it on `proxy` too.
     networks:
       - proxy
+      - browser
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=${PROXY_NETWORK:-proxy}"
@@ -40,11 +44,10 @@ services:
       - "traefik.http.routers.mangaweb.tls.certresolver=${TRAEFIK_CERTRESOLVER:-le}"
       - "traefik.http.routers.mangaweb.service=mangabm"
 
-  # manga-api only joins `proxy` in this override (see above), so headless-shell
-  # has to follow it there too or DNS resolution of headless-shell:9222 breaks.
-  headless-shell:
-    networks:
-      - proxy
+  # headless-shell is untouched here: it keeps its `browser` network membership
+  # from the base file and must never join `proxy` — that network is shared
+  # with whatever else sits behind Traefik on this host, and an exposed
+  # CDP endpoint on it would be remote code execution for any of them.
 
 networks:
   proxy:
diff --git a/docker-compose.yml b/docker-compose.yml
index 304ea69..3d53280 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -45,6 +45,8 @@ services:
     # the public internet does not.
     ports:
       - "127.0.0.1:8080:8080"
+    networks:
+      - browser
 
   headless-shell:
     image: chromedp/headless-shell:stable
@@ -55,12 +57,20 @@ services:
     # container's lifetime.
     init: true
     # Deliberately no `ports:` — an exposed CDP endpoint is remote code
-    # execution. Only the backend on the internal network may reach it.
+    # execution. Only manga-api, via the `browser` network below, may reach it.
     command:
       - --remote-debugging-address=0.0.0.0
       - --remote-debugging-port=9222
       - --disable-gpu
       - --no-sandbox
+    networks:
+      - browser
 
 volumes:
   bookmarks-data:
+
+networks:
+  # Not `internal: true`: headless Chrome still needs outbound access to reach
+  # kagane.to. Isolation here comes from membership (only manga-api and
+  # headless-shell join it), not from cutting egress.
+  browser: