diff --git a/.docker/docker-compose.proxy.yml b/.docker/docker-compose.proxy.yml
index b2e36a2b..21328efc 100644
--- a/.docker/docker-compose.proxy.yml
+++ b/.docker/docker-compose.proxy.yml
@@ -1,38 +1,49 @@
 services:
-  nginx-proxy:
-    image: nginxproxy/nginx-proxy:1.11.6-alpine@sha256:99376e95c8754547213d411222a2c4dca046d974e753ae2a1c9aef09b2c03364
+  traefik:
+    image: traefik:v3.7.13@sha256:f86a2cab1b5c649070c49f883c743dd32d8485a56e3368c5f93b9e91f1e91259
     container_name: librecode-dev-proxy
     labels:
       coop.librecode.dev-proxy: "true"
-    working_dir: /dashboard
-    command: ["forego", "start", "-r"]
+      traefik.enable: "true"
+      traefik.http.routers.librecode-api.rule: Path(`/api/http/routers`)
+      traefik.http.routers.librecode-api.priority: "200"
+      traefik.http.routers.librecode-api.entrypoints: api
+      traefik.http.routers.librecode-api.service: api@internal
+    command:
+      - --api=true
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.network=librecode-dev-proxy
+      - --entrypoints.web.address=:80
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --entrypoints.websecure.address=:443
+      - --entrypoints.api.address=:8080
+      - --entrypoints.websecure.asdefault=true
+      - --entrypoints.websecure.http.tls=true
     ports:
       - "${PROXY_IP_BIND:-127.0.0.1}:80:80"
       - "${PROXY_IP_BIND:-127.0.0.1}:443:443"
     volumes:
-      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/tmp/docker.sock:ro
-      - librecode-dev-proxy-vhost:/etc/nginx/vhost.d
-      - librecode-dev-proxy-assets:/dashboard:ro
-      - librecode-dev-proxy-log:/etc/nginx/log
-      - librecode-dev-proxy-certs:/etc/nginx/certs:ro
-    environment:
-      - ENABLE_IPV6=true
-      - VIRTUAL_HOST=localhost,*.localhost
-      - VIRTUAL_PORT=80
-      - SELF_SIGNED_HOST=localhost,*.localhost
+      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
     networks:
       - proxy
 
-  ssl-companion:
-    image: sebastienheyd/self-signed-proxy-companion:1.1.0@sha256:dd698341f804aaffe2974931a185aa088561d76094e040e374847f3a64004d43
-    container_name: librecode-dev-proxy-ssl-companion
+  dashboard:
+    image: nginx:1.31.5-alpine@sha256:72ba65eb42c10344912a84ff42408db7d34f2feb642204570ab8fc5ffd29f1d3
+    container_name: librecode-dev-dashboard
     labels:
-      coop.librecode.dev-proxy-companion: "true"
-    volumes:
-      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
-      - librecode-dev-proxy-certs:/etc/nginx/certs:rw
-    environment:
-      - NGINX_PROXY_CONTAINER=librecode-dev-proxy
+      coop.librecode.dev-proxy-dashboard: "true"
+      traefik.enable: "true"
+      traefik.http.routers.librecode-dashboard.rule: Host(`localhost`)
+      traefik.http.routers.librecode-dashboard.priority: "100"
+      traefik.http.routers.librecode-dashboard.service: librecode-dashboard
+      traefik.http.routers.librecode-dashboard-catchall.rule: HostRegexp(`[a-z0-9-]+\.localhost`)
+      traefik.http.routers.librecode-dashboard-catchall.priority: "1"
+      traefik.http.routers.librecode-dashboard-catchall.service: librecode-dashboard
+      traefik.http.routers.librecode-dashboard-catchall.middlewares: librecode-not-found
+      traefik.http.middlewares.librecode-not-found.replacepath.path: /__librecode_not_found__
+      traefik.http.services.librecode-dashboard.loadbalancer.server.port: "80"
     networks:
       - proxy
 
@@ -40,13 +51,3 @@ networks:
   proxy:
     name: librecode-dev-proxy
     external: true
-
-volumes:
-  librecode-dev-proxy-vhost:
-    name: librecode-dev-proxy-vhost
-  librecode-dev-proxy-assets:
-    name: librecode-dev-proxy-assets
-  librecode-dev-proxy-log:
-    name: librecode-dev-proxy-log
-  librecode-dev-proxy-certs:
-    name: librecode-dev-proxy-certs
diff --git a/.docker/nginx-proxy/*.localhost b/.docker/nginx-proxy/*.localhost
deleted file mode 100644
index b66d860e..00000000
--- a/.docker/nginx-proxy/*.localhost
+++ /dev/null
@@ -1,6 +0,0 @@
-root /usr/share/nginx/html;
-error_page 404 =404 @librecode_dashboard_404;
-
-location @librecode_dashboard_404 {
-    try_files /index.html =404;
-}
diff --git a/.docker/nginx-proxy/*.localhost_location_override b/.docker/nginx-proxy/*.localhost_location_override
deleted file mode 100644
index 421c127f..00000000
--- a/.docker/nginx-proxy/*.localhost_location_override
+++ /dev/null
@@ -1 +0,0 @@
-return 404;
diff --git a/.docker/nginx-proxy/Procfile b/.docker/nginx-proxy/Procfile
deleted file mode 100644
index c0f1ad20..00000000
--- a/.docker/nginx-proxy/Procfile
+++ /dev/null
@@ -1,2 +0,0 @@
-dockergen: docker-gen -config /dashboard/docker-gen.cfg -event-filter event=connect -event-filter event=disconnect
-nginx: nginx -g "daemon off;"
diff --git a/.docker/nginx-proxy/docker-gen.cfg b/.docker/nginx-proxy/docker-gen.cfg
deleted file mode 100644
index 15161780..00000000
--- a/.docker/nginx-proxy/docker-gen.cfg
+++ /dev/null
@@ -1,12 +0,0 @@
-[[config]]
-template = "/app/nginx.tmpl"
-dest = "/etc/nginx/conf.d/default.conf"
-watch = true
-wait = "100ms:500ms"
-notifycmd = "nginx -s reload"
-
-[[config]]
-template = "/dashboard/dashboard.tmpl"
-dest = "/usr/share/nginx/html/index.html"
-watch = true
-wait = "100ms:500ms"
diff --git a/.docker/nginx-proxy/localhost_location_override b/.docker/nginx-proxy/localhost_location_override
deleted file mode 100644
index b3f4e9c6..00000000
--- a/.docker/nginx-proxy/localhost_location_override
+++ /dev/null
@@ -1,2 +0,0 @@
-root /usr/share/nginx/html;
-try_files $uri /index.html =404;
diff --git a/.docker/scripts/proxy-coordinator.sh b/.docker/scripts/proxy-coordinator.sh
index 72f16a01..e6c9e70a 100755
--- a/.docker/scripts/proxy-coordinator.sh
+++ b/.docker/scripts/proxy-coordinator.sh
@@ -18,8 +18,8 @@ export COORDINATOR_CONTAINER PROJECT_NAME
 # analyze the complete dependency graph without file-wide suppressions.
 # shellcheck source=.docker/scripts/proxy/infrastructure.sh
 . "$proxy_lib_dir/infrastructure.sh"
-# shellcheck source=.docker/scripts/proxy/assets.sh
-. "$proxy_lib_dir/assets.sh"
+# shellcheck source=.docker/scripts/proxy/dashboard.sh
+. "$proxy_lib_dir/dashboard.sh"
 # shellcheck source=.docker/scripts/proxy/diagnostics.sh
 . "$proxy_lib_dir/diagnostics.sh"
 # shellcheck source=.docker/scripts/proxy/services.sh
@@ -86,9 +86,8 @@ wait_for_shutdown() {
 run() {
 	validate_environment
 	ensure_proxy_network
-	install_proxy_assets
-
 	proxy_state="$(ensure_proxy_running)"
+	install_dashboard_assets
 	install_runtime_diagnostics
 
 	acquire_proxy_lease
diff --git a/.docker/scripts/proxy/assets.sh b/.docker/scripts/proxy/assets.sh
deleted file mode 100644
index 58991c5a..00000000
--- a/.docker/scripts/proxy/assets.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/bin/sh
-
-proxy_helper_image() {
-	if [ -n "${PROXY_HELPER_IMAGE:-}" ]; then
-		printf '%s\n' "$PROXY_HELPER_IMAGE"
-		return 0
-	fi
-
-	container_image "${COORDINATOR_CONTAINER:-}"
-}
-
-copy_to_named_volume() {
-	volume="$1"
-	source="$2"
-	destination="$3"
-	helper_image="$(proxy_helper_image)"
-
-	[ -n "$helper_image" ] || return 1
-
-	Docker run --rm -i \
-		-v "$volume:/target" \
-		"$helper_image" \
-		tee "/target/$destination" \
-		< "$source" >/dev/null
-}
-
-install_proxy_assets() {
-	assets_volume="$(proxy_assets_volume_name)"
-	vhost_volume="$(proxy_vhost_volume_name)"
-	helper_image="$(proxy_helper_image)"
-
-	[ -n "$helper_image" ] || return 1
-
-	Docker volume create "$assets_volume" >/dev/null
-	Docker volume create "$vhost_volume" >/dev/null
-
-	Docker run --rm \
-		-v "$assets_volume:/target" \
-		"$helper_image" \
-		sh -c 'rm -f /target/Procfile /target/docker-gen.cfg /target/dashboard.tmpl'
-
-	copy_to_named_volume "$assets_volume" "${PROJECT_DIR:-}/.docker/nginx-proxy/Procfile" Procfile
-	copy_to_named_volume "$assets_volume" "${PROJECT_DIR:-}/.docker/nginx-proxy/docker-gen.cfg" docker-gen.cfg
-	copy_to_named_volume "$assets_volume" "${PROJECT_DIR:-}/.docker/nginx-proxy/dashboard.tmpl" dashboard.tmpl
-
-	Docker run --rm \
-		-v "$vhost_volume:/target" \
-		"$helper_image" \
-		sh -c 'rm -f /target/librecode-localhost.conf /target/localhost /target/localhost_location_override /target/\*.localhost /target/\*.localhost_location_override'
-
-	copy_to_named_volume "$vhost_volume" "${PROJECT_DIR:-}/.docker/nginx-proxy/localhost_location_override" localhost_location_override
-	copy_to_named_volume "$vhost_volume" "${PROJECT_DIR:-}/.docker/nginx-proxy/*.localhost" '*.localhost'
-	copy_to_named_volume "$vhost_volume" "${PROJECT_DIR:-}/.docker/nginx-proxy/*.localhost_location_override" '*.localhost_location_override'
-}
diff --git a/.docker/scripts/proxy/dashboard.sh b/.docker/scripts/proxy/dashboard.sh
new file mode 100644
index 00000000..c81ac158
--- /dev/null
+++ b/.docker/scripts/proxy/dashboard.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+install_dashboard_assets() {
+	dashboard_container="${PROXY_DASHBOARD_CONTAINER:-librecode-dev-dashboard}"
+
+	Docker cp "${PROJECT_DIR:-}/.docker/traefik/dashboard.html" "$dashboard_container:/usr/share/nginx/html/index.html"
+	Docker cp "${PROJECT_DIR:-}/.docker/traefik/dashboard.conf" "$dashboard_container:/etc/nginx/conf.d/default.conf"
+	Docker exec "$dashboard_container" nginx -s reload
+}
diff --git a/.docker/scripts/proxy/diagnostics.sh b/.docker/scripts/proxy/diagnostics.sh
index aaf79ea0..1710e3cb 100644
--- a/.docker/scripts/proxy/diagnostics.sh
+++ b/.docker/scripts/proxy/diagnostics.sh
@@ -79,10 +79,13 @@ runtime_diagnostics_json() {
 }
 
 install_runtime_diagnostics() {
-	proxy_container="$(compatible_proxy_container)"
-	[ -n "$proxy_container" ] || return 1
+	dashboard_container="${PROXY_DASHBOARD_CONTAINER:-librecode-dev-dashboard}"
+
+	if ! Docker inspect "$dashboard_container" >/dev/null 2>&1; then
+		return 1
+	fi
 
 	runtime_diagnostics_json |
-		Docker exec -i "$proxy_container" \
+		Docker exec -i "$dashboard_container" \
 			sh -c 'cat > /usr/share/nginx/html/runtime.json'
 }
diff --git a/.docker/traefik/dashboard.conf b/.docker/traefik/dashboard.conf
new file mode 100644
index 00000000..d49028c4
--- /dev/null
+++ b/.docker/traefik/dashboard.conf
@@ -0,0 +1,29 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location = /__librecode_not_found__ {
+        return 404;
+    }
+
+    error_page 404 /index.html;
+
+    location = /index.html {
+    }
+
+    location = /runtime.json {
+        try_files $uri =404;
+    }
+
+    location = /api/http/routers {
+        proxy_pass http://traefik:8080;
+        proxy_set_header Host localhost;
+    }
+
+    location / {
+        try_files $uri /index.html;
+    }
+}
diff --git a/.docker/nginx-proxy/dashboard.tmpl b/.docker/traefik/dashboard.html
similarity index 78%
rename from .docker/nginx-proxy/dashboard.tmpl
rename to .docker/traefik/dashboard.html
index 57df7502..38f99f08 100644
--- a/.docker/nginx-proxy/dashboard.tmpl
+++ b/.docker/traefik/dashboard.html
@@ -1,42 +1,3 @@
-{{- $routes := list -}}
-{{- $proxyNetworks := dict -}}
-{{- range $container := . -}}
-  {{- if eq (index $container.Labels "coop.librecode.dev-proxy") "true" -}}
-    {{- range $network := $container.Networks -}}
-      {{- $_ := set $proxyNetworks $network.Name true -}}
-    {{- end -}}
-  {{- end -}}
-{{- end -}}
-{{- range $hostname, $containers := groupByMulti . "Env.VIRTUAL_HOST" "," -}}
-  {{- $hostname = trim $hostname -}}
-  {{- if or (eq $hostname "") (eq $hostname "localhost") (eq $hostname "*.localhost") -}}
-    {{- continue -}}
-  {{- end -}}
-
-  {{- range $container := $containers -}}
-    {{- $reachableFromProxy := false -}}
-    {{- range $network := $container.Networks -}}
-      {{- if index $proxyNetworks $network.Name -}}
-        {{- $reachableFromProxy = true -}}
-      {{- end -}}
-    {{- end -}}
-    {{- if not $reachableFromProxy -}}
-      {{- continue -}}
-    {{- end -}}
-
-    {{- $project := index $container.Labels "com.docker.compose.project" -}}
-    {{- $service := index $container.Labels "com.docker.compose.service" -}}
-    {{- if not $project -}}
-      {{- $project = "Docker" -}}
-    {{- end -}}
-    {{- if not $service -}}
-      {{- $service = "Service" -}}
-    {{- end -}}
-
-    {{- $routes = append $routes (dict "host" $hostname "project" $project "service" $service) -}}
-    {{- break -}}
-  {{- end -}}
-{{- end -}}
 <!doctype html>
 <html lang="en">
 <head>
@@ -82,7 +43,7 @@ <h2>⚠ Environment not found</h2>
     </section>
 
     <h2>Active environments</h2>
-    <div id="environments"></div>
+    <div id="environments"><p class="muted">Loading active development routes…</p></div>
 
     <section id="runtime-section" hidden>
       <h2>Environment checks</h2>
@@ -102,27 +63,44 @@ <h2>Environment checks</h2>
     </footer>
   </main>
 
-  <script type="application/json" id="routes">{{ toJson $routes }}</script>
   <script>
     const serviceNames = {
-      nginx: 'Nextcloud',
+      nextcloud: 'Nextcloud',
       mailpit: 'Mailpit',
       playwright: 'Playwright',
       eurooffice: 'EuroOffice',
       'signal-gateway': 'Signal Gateway',
     };
 
-    const routes = JSON.parse(document.getElementById('routes').textContent)
-      .filter(({ host }) => !host.includes('*') && !host.startsWith('~'))
-      .sort((a, b) => a.project.localeCompare(b.project) || a.host.localeCompare(b.host));
-
-    const environments = document.getElementById('environments');
-    if (routes.length === 0) {
-      const empty = document.createElement('p');
-      empty.className = 'muted';
-      empty.textContent = 'No development environments are active.';
-      environments.appendChild(empty);
-    } else {
+    const routerPrefix = 'librecode-';
+    const routerSeparator = '--';
+
+    const parseRoute = (router) => {
+      const name = String(router.name || '').replace(/@docker$/, '');
+      if (!name.startsWith(routerPrefix) || !name.includes(routerSeparator)) return null;
+
+      const payload = name.slice(routerPrefix.length);
+      const separatorIndex = payload.lastIndexOf(routerSeparator);
+      const project = payload.slice(0, separatorIndex);
+      const service = payload.slice(separatorIndex + routerSeparator.length);
+      const match = String(router.rule || '').match(/Host\(\`([^\`]+)\`\)/);
+
+      if (!project || !service || !match) return null;
+      return { host: match[1], project, service };
+    };
+
+    const renderRoutes = (routes) => {
+      const environments = document.getElementById('environments');
+      environments.replaceChildren();
+
+      if (routes.length === 0) {
+        const empty = document.createElement('p');
+        empty.className = 'muted';
+        empty.textContent = 'No development environments are active.';
+        environments.appendChild(empty);
+        return;
+      }
+
       let currentProject = null;
       let list = null;
 
@@ -147,10 +125,12 @@ <h2>Environment checks</h2>
         item.append(label, link);
         list.appendChild(item);
       }
-    }
+    };
+
+    const showUnknownHost = (routes) => {
+      const requestedHost = window.location.hostname;
+      if (requestedHost === 'localhost') return;
 
-    const requestedHost = window.location.hostname;
-    if (requestedHost !== 'localhost') {
       const panel = document.getElementById('not-found');
       document.getElementById('requested-host').textContent = requestedHost;
       panel.hidden = false;
@@ -178,7 +158,11 @@ <h2>Environment checks</h2>
         link.textContent = closest;
         suggestion.hidden = false;
       }
-    } else {
+    };
+
+    const loadRuntime = () => {
+      if (window.location.hostname !== 'localhost') return;
+
       const runtimeSection = document.getElementById('runtime-section');
       runtimeSection.hidden = false;
 
@@ -219,7 +203,6 @@ <h2>Environment checks</h2>
 
             const panel = document.createElement('div');
             panel.className = 'runtime-hint';
-
             const title = document.createElement('strong');
             title.textContent = 'ℹ Shorter local URLs are available';
 
@@ -252,7 +235,31 @@ <h2>Environment checks</h2>
           checks.textContent = 'Runtime information is not available.';
           checks.className = 'muted';
         });
-    }
+    };
+
+    fetch('/api/http/routers', { cache: 'no-store' })
+      .then((response) => {
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
+        return response.json();
+      })
+      .then((routers) => {
+        const routes = routers
+          .filter(({ provider, status }) => provider === 'docker' && status === 'enabled')
+          .map(parseRoute)
+          .filter(Boolean)
+          .sort((a, b) => a.project.localeCompare(b.project) || a.host.localeCompare(b.host));
+
+        renderRoutes(routes);
+        showUnknownHost(routes);
+      })
+      .catch(() => {
+        const environments = document.getElementById('environments');
+        environments.textContent = 'Active route information is not available.';
+        environments.className = 'muted';
+        showUnknownHost([]);
+      });
+
+    loadRuntime();
   </script>
 </body>
 </html>
diff --git a/docker-compose.yml b/docker-compose.yml
index b892af83..04c155e9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -59,10 +59,11 @@ services:
       - ./volumes/nextcloud:/var/www/html:ro
       - ./volumes/nginx/includes:/etc/nginx/conf.d/includes/
       - ./volumes/nginx/certs:/certs
-    environment:
-      - VIRTUAL_HOST=${COMPOSE_PROJECT_NAME}.localhost
-      - VIRTUAL_PORT=80
-      - SELF_SIGNED_HOST=${COMPOSE_PROJECT_NAME}.localhost
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
+      - "traefik.http.routers.librecode-${COMPOSE_PROJECT_NAME}--nextcloud.rule=Host(`${COMPOSE_PROJECT_NAME}.localhost`)"
+      - "traefik.http.services.librecode-${COMPOSE_PROJECT_NAME}--nextcloud.loadbalancer.server.port=80"
   proxy-coordinator:
     image: docker:29.8.0-cli@sha256:eccaacfeed644c7de222ff047483568cb988dde95476fbaaf10ea2d04921bb66
     entrypoint: ["/bin/sh", "/usr/local/lib/librecode/proxy-coordinator.sh"]
@@ -85,10 +86,11 @@ services:
       - nextcloud
   mailpit:
     image: axllent/mailpit:v1.31.1@sha256:98b916bd3c8d61f7633a52d3ea2f58d00620cb01ca57ab59edde68c347a95365
-    environment:
-      - VIRTUAL_HOST=${COMPOSE_PROJECT_NAME}-mailpit.localhost
-      - VIRTUAL_PORT=8025
-      - SELF_SIGNED_HOST=${COMPOSE_PROJECT_NAME}-mailpit.localhost
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
+      - "traefik.http.routers.librecode-${COMPOSE_PROJECT_NAME}--mailpit.rule=Host(`${COMPOSE_PROJECT_NAME}-mailpit.localhost`)"
+      - "traefik.http.services.librecode-${COMPOSE_PROJECT_NAME}--mailpit.loadbalancer.server.port=8025"
   redis:
     image: redis:8.8.2@sha256:37227fff5638322f4ebea25d6d0dc3ee50848604e82b81426f11507b3ec7d2cc
   eurooffice:
@@ -105,9 +107,11 @@ services:
       - JWT_SECRET=${JWT_SECRET:-my_jwt_secret}
       - HOST_UID=${HOST_UID:-1000}
       - HOST_GID=${HOST_GID:-1000}
-      - VIRTUAL_HOST=${COMPOSE_PROJECT_NAME}-eurooffice.localhost
-      - VIRTUAL_PORT=80
-      - SELF_SIGNED_HOST=${COMPOSE_PROJECT_NAME}-eurooffice.localhost
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
+      - "traefik.http.routers.librecode-${COMPOSE_PROJECT_NAME}--eurooffice.rule=Host(`${COMPOSE_PROJECT_NAME}-eurooffice.localhost`)"
+      - "traefik.http.services.librecode-${COMPOSE_PROJECT_NAME}--eurooffice.loadbalancer.server.port=80"
     extra_hosts:
       - host.docker.internal:host-gateway
   playwright:
@@ -122,9 +126,11 @@ services:
       - PLAYWRIGHT_BASE_URL=${PLAYWRIGHT_BASE_URL:-https://${COMPOSE_PROJECT_NAME}.localhost}
       - NODE_ENV=test
       - CI=${CI:-false}
-      - VIRTUAL_HOST=${COMPOSE_PROJECT_NAME}-playwright.localhost
-      - VIRTUAL_PORT=9323
-      - SELF_SIGNED_HOST=${COMPOSE_PROJECT_NAME}-playwright.localhost
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
+      - "traefik.http.routers.librecode-${COMPOSE_PROJECT_NAME}--playwright.rule=Host(`${COMPOSE_PROJECT_NAME}-playwright.localhost`)"
+      - "traefik.http.services.librecode-${COMPOSE_PROJECT_NAME}--playwright.loadbalancer.server.port=9323"
     command: sleep infinity
     depends_on:
       - nextcloud
@@ -140,9 +146,11 @@ services:
       - ./volumes/signal:/home/.local/share/signal-cli
     environment:
       - LOG_LEVEL=info
-      - VIRTUAL_HOST=${COMPOSE_PROJECT_NAME}-signal.localhost
-      - VIRTUAL_PORT=8080
-      - SELF_SIGNED_HOST=${COMPOSE_PROJECT_NAME}-signal.localhost
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
+      - "traefik.http.routers.librecode-${COMPOSE_PROJECT_NAME}--signal-gateway.rule=Host(`${COMPOSE_PROJECT_NAME}-signal.localhost`)"
+      - "traefik.http.services.librecode-${COMPOSE_PROJECT_NAME}--signal-gateway.loadbalancer.server.port=8080"
   whatsapp.web:
     image: aldinokemal2104/go-whatsapp-web-multidevice
     profiles:
diff --git a/docs/advanced-setup.md b/docs/advanced-setup.md
index 677935f5..f8ea2a04 100644
--- a/docs/advanced-setup.md
+++ b/docs/advanced-setup.md
@@ -107,7 +107,7 @@ Expose development services only on trusted networks and with an appropriate hos
 
 ## Docker daemon access
 
-The proxy coordinator, reverse proxy, and certificate companion access the Docker daemon as part of the development workflow. This is an intentional trust boundary: code running through these infrastructure components can interact with the local Docker daemon.
+The proxy coordinator and Traefik reverse proxy access the Docker daemon as part of the development workflow. This is an intentional trust boundary: code running through these infrastructure components can interact with the local Docker daemon.
 
 Application containers do not receive the Docker socket. Use this development environment only with repository code you trust.
 
diff --git a/tests/proxy/compose-policy.bats b/tests/proxy/compose-policy.bats
index a5d151aa..7afafcb5 100644
--- a/tests/proxy/compose-policy.bats
+++ b/tests/proxy/compose-policy.bats
@@ -10,13 +10,8 @@ setup() {
 	grep -Eq '^[[:space:]]+image: redis:[0-9]+\.[0-9]+\.[0-9]+@sha256:[0-9a-f]{64}$' "$REPO_ROOT/docker-compose.yml"
 	grep -Eq '^[[:space:]]+image: mysql:8\.4@sha256:[0-9a-f]{64}$' "$REPO_ROOT/.docker/database-services.yml"
 	grep -Eq '^[[:space:]]+image: postgres:13-alpine@sha256:[0-9a-f]{64}$' "$REPO_ROOT/.docker/database-services.yml"
-	grep -Eq '^[[:space:]]+image: nginxproxy/nginx-proxy:[0-9]+\.[0-9]+\.[0-9]+-alpine@sha256:[0-9a-f]{64}$' "$REPO_ROOT/.docker/docker-compose.proxy.yml"
-	grep -Eq '^[[:space:]]+image: sebastienheyd/self-signed-proxy-companion:[0-9]+\.[0-9]+\.[0-9]+@sha256:[0-9a-f]{64}$' "$REPO_ROOT/.docker/docker-compose.proxy.yml"
-}
-
-@test "proxy helper reuses the coordinator image instead of duplicating its version" {
-	grep -q 'container_image "${COORDINATOR_CONTAINER:-}"' "$REPO_ROOT/.docker/scripts/proxy/assets.sh"
-	! grep -Eq 'docker:[0-9]+\.[0-9]+\.[0-9]+-cli@sha256:' "$REPO_ROOT/.docker/scripts/proxy/assets.sh"
+	grep -Eq '^[[:space:]]+image: traefik:v[0-9]+\.[0-9]+\.[0-9]+@sha256:[0-9a-f]{64}$' "$REPO_ROOT/.docker/docker-compose.proxy.yml"
+	grep -Eq '^[[:space:]]+image: nginx:[0-9]+\.[0-9]+\.[0-9]+-alpine@sha256:[0-9a-f]{64}$' "$REPO_ROOT/.docker/docker-compose.proxy.yml"
 }
 
 @test "proxy integration fixture images are pinned by tag and digest" {
@@ -60,13 +55,14 @@ setup() {
 	[ "$main_socket_mounts" -eq 1 ]
 
 	proxy_socket_mounts="$(grep -Ec '^[[:space:]]+- .*DOCKER_SOCKET.*:/.*docker\.sock:ro$' "$REPO_ROOT/.docker/docker-compose.proxy.yml")"
-	[ "$proxy_socket_mounts" -eq 2 ]
+	[ "$proxy_socket_mounts" -eq 1 ]
 }
 
-@test "dashboard does not use innerHTML for Docker metadata" {
-	! grep -q 'innerHTML' "$REPO_ROOT/.docker/nginx-proxy/dashboard.tmpl"
-	grep -q 'textContent = currentProject' "$REPO_ROOT/.docker/nginx-proxy/dashboard.tmpl"
-	grep -q 'textContent = link.href' "$REPO_ROOT/.docker/nginx-proxy/dashboard.tmpl"
+@test "dashboard does not use innerHTML for Traefik route metadata" {
+	dashboard="$REPO_ROOT/.docker/traefik/dashboard.html"
+	! grep -q 'innerHTML' "$dashboard"
+	grep -q 'heading.textContent = currentProject' "$dashboard"
+	grep -q 'link.textContent = link.href' "$dashboard"
 }
 
 @test "GitHub Actions are pinned to immutable commit SHAs" {
diff --git a/tests/proxy/fixtures/compose.yml b/tests/proxy/fixtures/compose.yml
index d1304ea8..a0fae0e9 100644
--- a/tests/proxy/fixtures/compose.yml
+++ b/tests/proxy/fixtures/compose.yml
@@ -1,10 +1,11 @@
 services:
   nginx:
     image: nginx:1.31.5-alpine@sha256:72ba65eb42c10344912a84ff42408db7d34f2feb642204570ab8fc5ffd29f1d3
-    environment:
-      - VIRTUAL_HOST=${COMPOSE_PROJECT_NAME}.localhost
-      - VIRTUAL_PORT=80
-      - SELF_SIGNED_HOST=${COMPOSE_PROJECT_NAME}.localhost
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
+      - "traefik.http.routers.librecode-${COMPOSE_PROJECT_NAME}--nextcloud.rule=Host(`${COMPOSE_PROJECT_NAME}.localhost`)"
+      - "traefik.http.services.librecode-${COMPOSE_PROJECT_NAME}--nextcloud.loadbalancer.server.port=80"
 
   proxy-coordinator:
     image: docker:29.8.0-cli@sha256:eccaacfeed644c7de222ff047483568cb988dde95476fbaaf10ea2d04921bb66
diff --git a/tests/proxy/integration.bats b/tests/proxy/integration.bats
index 65e8665f..95f36fc8 100644
--- a/tests/proxy/integration.bats
+++ b/tests/proxy/integration.bats
@@ -73,10 +73,10 @@ wait_for_https_path_status() {
 	path="$2"
 	expected="$3"
 
-	for _ in $(seq 1 60); do
+	for _ in $(seq 1 30); do
 		status="$(curl --silent --show-error --insecure \
-			--connect-timeout 2 \
-			--max-time 5 \
+			--connect-timeout 1 \
+			--max-time 2 \
 			--resolve "$host:443:127.0.0.1" \
 			--output "$BODY" \
 			--write-out '%{http_code}' \
@@ -84,6 +84,13 @@ wait_for_https_path_status() {
 		[ "$status" = "$expected" ] && return 0
 		sleep 0.5
 	done
+	printf 'Timed out waiting for https://%s%s to return %s; last status was %s\n' "$host" "$path" "$expected" "${status:-none}" >&2
+	docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' >&2 || true
+	docker inspect proxytesta-nginx-1 --format '{{json .NetworkSettings.Networks}}' >&2 2>/dev/null || true
+	curl --silent --show-error --insecure --connect-timeout 1 --max-time 2 \
+		--resolve 'localhost:443:127.0.0.1' https://localhost/api/http/routers >&2 || true
+	docker logs librecode-dev-proxy >&2 || true
+	docker logs librecode-dev-dashboard >&2 || true
 	return 1
 }
 
@@ -101,7 +108,7 @@ certificate_matches_host() {
 	compose_test proxytesta up --detach
 
 	wait_for_running librecode-dev-proxy
-	wait_for_running librecode-dev-proxy-ssl-companion
+	wait_for_running librecode-dev-dashboard
 
 	wait_for_network librecode-dev-proxy proxytesta_default
 	backend_networks="$(docker inspect --format '{{json .NetworkSettings.Networks}}' proxytesta-nginx-1)"
@@ -120,6 +127,9 @@ certificate_matches_host() {
 	grep -q 'Report an issue' "$BODY"
 	grep -q 'Star on GitHub' "$BODY"
 
+	wait_for_https_path_status localhost /api/http/routers 200
+	grep -q 'librecode-proxytesta--nextcloud' "$BODY"
+
 	wait_for_https_path_status localhost /runtime.json 200
 	grep -q '"docker":"' "$BODY"
 	grep -q '"runc":"' "$BODY"
@@ -138,7 +148,7 @@ certificate_matches_host() {
 	compose_test proxytesta stop
 
 	wait_for_absent librecode-dev-proxy
-	wait_for_absent librecode-dev-proxy-ssl-companion
+	wait_for_absent librecode-dev-dashboard
 }
 
 @test "Ctrl+C on attached compose stops the last shared proxy promptly" {
@@ -152,7 +162,7 @@ certificate_matches_host() {
 	compose_pid=$!
 
 	wait_for_running librecode-dev-proxy
-	wait_for_running librecode-dev-proxy-ssl-companion
+	wait_for_running librecode-dev-dashboard
 	wait_for_https_status proxytesta.localhost 200
 
 	started_at="$(date +%s)"
@@ -161,7 +171,7 @@ certificate_matches_host() {
 	finished_at="$(date +%s)"
 
 	wait_for_absent librecode-dev-proxy
-	wait_for_absent librecode-dev-proxy-ssl-companion
+	wait_for_absent librecode-dev-dashboard
 
 	elapsed=$((finished_at - started_at))
 	[ "$elapsed" -lt 10 ]
@@ -183,5 +193,5 @@ certificate_matches_host() {
 	compose_test proxytestb stop
 
 	wait_for_absent librecode-dev-proxy
-	wait_for_absent librecode-dev-proxy-ssl-companion
+	wait_for_absent librecode-dev-dashboard
 }