diff --git a/apps/lnd-ui/manifest.yml b/apps/lnd-ui/manifest.yml
index ff17aa77..e15bb0ad 100644
--- a/apps/lnd-ui/manifest.yml
+++ b/apps/lnd-ui/manifest.yml
@@ -22,10 +22,14 @@ app:
 
   security:
     readonly_root: false
-    network_policy: host
+    network_policy: bridge
 
-  # Host networking: nginx listens on 8081 directly on the host IP.
-  ports: []
+  # Bridge networking via archy-net. Container nginx listens on 80;
+  # host nginx proxies /app/lnd/ -> 127.0.0.1:8081 -> container:80.
+  ports:
+    - host: 8081
+      container: 80
+      protocol: tcp
 
   volumes: []
 
diff --git a/docker/lnd-ui/Dockerfile b/docker/lnd-ui/Dockerfile
index da31def2..d38f5e8c 100644
--- a/docker/lnd-ui/Dockerfile
+++ b/docker/lnd-ui/Dockerfile
@@ -22,6 +22,6 @@ RUN sed -i 's/^user  nginx;/user  root;/' /etc/nginx/nginx.conf && \
     mkdir -p /var/cache/nginx/client_temp /var/cache/nginx/proxy_temp \
              /var/cache/nginx/fastcgi_temp /var/cache/nginx/uwsgi_temp \
              /var/cache/nginx/scgi_temp
-EXPOSE 8080
+EXPOSE 80
 ENTRYPOINT []
 CMD ["nginx", "-g", "daemon off;"]
diff --git a/docker/lnd-ui/nginx.conf b/docker/lnd-ui/nginx.conf
index 5d6f0c17..1664890f 100644
--- a/docker/lnd-ui/nginx.conf
+++ b/docker/lnd-ui/nginx.conf
@@ -1,5 +1,5 @@
 server {
-    listen 8081;
+    listen 80;
     server_name _;
 
     root /usr/share/nginx/html;
diff --git a/scripts/first-boot-containers.sh b/scripts/first-boot-containers.sh
index a604b6c8..a26d2bf2 100644
--- a/scripts/first-boot-containers.sh
+++ b/scripts/first-boot-containers.sh
@@ -1242,9 +1242,9 @@ for ui in bitcoin-ui lnd-ui electrs-ui; do
   fi
   case $ui in
     # UI containers use --network host so they can proxy to localhost services
-    # Internal nginx ports: bitcoin-ui=8334, electrs-ui=50002, lnd-ui=8080 (host 8081)
+    # Internal nginx ports: bitcoin-ui=8334, electrs-ui=50002, lnd-ui=80 (host 8081)
     bitcoin-ui)  PORT_ARG=""; NET_ARG="--network host"; REG_IMG="${BITCOIN_UI_IMAGE}" ;;
-    lnd-ui)      PORT_ARG="-p 8081:8080"; NET_ARG=""; REG_IMG="${LND_UI_IMAGE}" ;;
+    lnd-ui)      PORT_ARG="-p 8081:80"; NET_ARG=""; REG_IMG="${LND_UI_IMAGE}" ;;
     electrs-ui)  PORT_ARG=""; NET_ARG="--network host"; REG_IMG="${ELECTRS_UI_IMAGE}" ;;
   esac
   CONTAINER_NAME="archy-$ui"