diff --git a/.env.example b/.env.example
index 0bcf871..32d3f11 100644
--- a/.env.example
+++ b/.env.example
@@ -1,2 +1,4 @@
 DOMAIN=local.example.com
+HTTP_PORT=8080
+HTTPS_PORT=8443
 UPSTREAM_URL=http://host.docker.internal:3000
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index eb01982..721d1e3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,6 +8,9 @@ on:
 
 env:
   DOMAIN: sslproxy.stackpop.com
+  HTTP_PORT: 9080
+  HTTPS_PORT: 9443
+  UPSTREAM_URL: http://host.docker.internal:3000
 
 jobs:
   test:
@@ -24,7 +27,9 @@ jobs:
       - name: Create .env
         run: |
           echo "DOMAIN=${{ env.DOMAIN }}" > .env
-          echo "UPSTREAM_URL=http://host.docker.internal:3000" >> .env
+          echo "HTTP_PORT=${{ env.HTTP_PORT }}" >> .env
+          echo "HTTPS_PORT=${{ env.HTTPS_PORT }}" >> .env
+          echo "UPSTREAM_URL=${{ env.UPSTREAM_URL }}" >> .env
 
       - name: Add test domain to hosts
         run: echo "127.0.0.1 ${{ env.DOMAIN }}" | sudo tee -a /etc/hosts
@@ -52,12 +57,11 @@ jobs:
 
       - name: Test HTTP redirect
         run: |
-          curl -s -o /dev/null -w "%{http_code}" http://${{ env.DOMAIN }}:8080 | grep -q "301\|308"
+          curl -s -o /dev/null -w "%{http_code}" http://${{ env.DOMAIN }}:${{ env.HTTP_PORT }} | grep -q "301\|308"
 
       - name: Test HTTPS proxies to upstream
         run: |
-          curl -s --cacert certs/${{ env.DOMAIN }}.rootCA.pem https://${{ env.DOMAIN }}:8443 | grep -q "nginx"
-
+          curl -s --cacert certs/${{ env.DOMAIN }}.rootCA.pem https://${{ env.DOMAIN }}:${{ env.HTTPS_PORT }} | grep -q "nginx"
       - name: Show logs on failure
         if: failure()
         run: docker compose logs
diff --git a/CLAUDE.md b/CLAUDE.md
index d9059d5..84ecd1c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -40,6 +40,8 @@ Environment variables (set in `.env`):
 
 - `DOMAIN` - Domain name for SSL cert (default: `localhost`)
 - `UPSTREAM_URL` - URL for your local app (default: `http://host.docker.internal:3000`)
+- `HTTP_PORT` - HTTP port for redirects (default: `8080`)
+- `HTTPS_PORT` - HTTPS port for proxy (default: `8443`)
 
 ## Files
 
@@ -51,5 +53,5 @@ Environment variables (set in `.env`):
 
 ## Ports
 
-- `8080` → HTTP (redirects to HTTPS on 8443)
-- `8443` → HTTPS (proxies to `${UPSTREAM_URL}`)
+- `${HTTP_PORT}` (default `8080`) → HTTP (redirects to HTTPS)
+- `${HTTPS_PORT}` (default `8443`) → HTTPS (proxies to `${UPSTREAM_URL}`)
diff --git a/README.md b/README.md
index 576fa81..df58e9a 100644
--- a/README.md
+++ b/README.md
@@ -101,12 +101,14 @@ Note (Linux): Requires Docker Engine 20.10+ for `host-gateway` support.
 | Variable       | Default                            | Description            |
 | -------------- | ---------------------------------- | ---------------------- |
 | `DOMAIN`       | `localhost`                        | Domain for SSL cert    |
+| `HTTP_PORT`    | `8080`                             | HTTP port (redirects)  |
+| `HTTPS_PORT`   | `8443`                             | HTTPS port (proxy)     |
 | `UPSTREAM_URL` | `http://host.docker.internal:3000` | URL for your local app |
 
 ## Ports
 
-- `8080` - HTTP (redirects to HTTPS)
-- `8443` - HTTPS
+- `HTTP_PORT` (default `8080`) - HTTP (redirects to HTTPS)
+- `HTTPS_PORT` (default `8443`) - HTTPS
 
 ## Layout
 
diff --git a/config/Caddyfile b/config/Caddyfile
index e551ffa..5e17001 100644
--- a/config/Caddyfile
+++ b/config/Caddyfile
@@ -1,5 +1,5 @@
 :80 {
-    redir https://{$DOMAIN:localhost}:8443{uri} permanent
+    redir https://{$DOMAIN:localhost}:{$HTTPS_PORT:8443}{uri} permanent
 }
 
 {$DOMAIN:localhost} {
diff --git a/docker-compose.yml b/docker-compose.yml
index 340f49a..7717e56 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -17,11 +17,12 @@ services:
       dockerfile: Dockerfile.caddy
     container_name: ssl-proxy
     ports:
-      - "8080:80"
-      - "8443:443"
+      - "${HTTP_PORT:-8080}:80"
+      - "${HTTPS_PORT:-8443}:443"
     environment:
       - DOMAIN=${DOMAIN:-localhost}
       - UPSTREAM_URL=${UPSTREAM_URL:-http://host.docker.internal:3000}
+      - HTTPS_PORT=${HTTPS_PORT:-8443}
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes: