diff --git a/stacks/portainer/README.md b/stacks/portainer/README.md
index 3cc6ca0..22a11a2 100644
--- a/stacks/portainer/README.md
+++ b/stacks/portainer/README.md
@@ -4,7 +4,7 @@ Docker container management UI — the "operator console" for cloud and edge.
 
 ## Access
 
-Portainer ingresses through nginx-proxy: `https://portainer.wbd-rd.nl/`. No host port is published by default.
+Portainer ingresses through nginx-proxy: `https://ops.wbd-rd.nl/`. No host port is published by default.
 
 For emergency ops (nginx down, etc.), uncomment the `ports:` block in `compose.yml` and `docker compose up -d portainer` to expose `:9443` and `:8000` directly.
 
diff --git a/stacks/portainer/compose.yml b/stacks/portainer/compose.yml
index aeec4c0..b40a3f1 100644
--- a/stacks/portainer/compose.yml
+++ b/stacks/portainer/compose.yml
@@ -1,6 +1,6 @@
 # portainer — container management UI (operator console)
 # Networks: mgmt (docker socket plane) + app (nginx-proxy reaches HTTPS upstream)
-# Ingress: nginx-proxy → portainer:9443 (self-signed upstream cert) → portainer.wbd-rd.nl
+# Ingress: nginx-proxy → portainer:9443 (self-signed upstream cert) → ops.wbd-rd.nl
 #
 # Direct :9443 host access is intentionally NOT published anymore — re-enable
 # only for emergency ops by uncommenting the `ports:` block below.