diff --git a/infra/nix/nginx.conf.template b/infra/nix/nginx.conf.template
index b6b0fc4..c157bf6 100644
--- a/infra/nix/nginx.conf.template
+++ b/infra/nix/nginx.conf.template
@@ -12,11 +12,11 @@ http {
   }
 
   server {
-    listen 8080;
+    listen 4009;
     server_name _;
 
     # Use relative redirects (Location: /dashboard/) instead of absolute
-    # URLs that leak the internal listen port (8080) through Traefik.
+    # URLs that leak the internal listen port (4009) through Traefik.
     absolute_redirect off;
 
     gzip on;
@@ -24,7 +24,7 @@ http {
     gzip_min_length 256;
 
     location ^~ /api {
-      proxy_pass http://127.0.0.1:3001$uri$is_args$args;
+      proxy_pass http://127.0.0.1:4001$uri$is_args$args;
       proxy_set_header Host              $host;
       proxy_set_header X-Real-IP         $remote_addr;
       proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
@@ -32,7 +32,7 @@ http {
     }
 
     location ^~ /ws {
-      proxy_pass http://127.0.0.1:3001$uri$is_args$args;
+      proxy_pass http://127.0.0.1:4001$uri$is_args$args;
       proxy_http_version 1.1;
       proxy_set_header Upgrade              $http_upgrade;
       proxy_set_header Connection           $connection_upgrade;