diff --git a/image-recipe/configs/nginx-archipelago.conf b/image-recipe/configs/nginx-archipelago.conf
index c2795ae8..ca191d87 100644
--- a/image-recipe/configs/nginx-archipelago.conf
+++ b/image-recipe/configs/nginx-archipelago.conf
@@ -327,7 +327,7 @@ server {
         sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
     }
     location /app/onlyoffice/ {
-        proxy_pass http://127.0.0.1:9980/;
+        proxy_pass http://127.0.0.1:8044/;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -444,7 +444,7 @@ server {
         sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
     }
     location /app/fedimint/ {
-        proxy_pass http://127.0.0.1:8175/;
+        proxy_pass http://127.0.0.1:8174/;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -478,7 +478,9 @@ server {
         sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
     }
     location /app/tailscale/ {
-        proxy_pass http://127.0.0.1:8240/;
+        # Tailscale has no web UI — managed via CLI/Tailscale app
+        # proxy_pass placeholder for future Tailscale admin UI
+        return 503;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -553,7 +555,7 @@ server {
         sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
     }
     location /app/nginx-proxy-manager/ {
-        proxy_pass http://127.0.0.1:81/;
+        proxy_pass http://127.0.0.1:8181/;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
diff --git a/image-recipe/configs/snippets/archipelago-https-app-proxies.conf b/image-recipe/configs/snippets/archipelago-https-app-proxies.conf
index 2e1bddd8..c78d0b7f 100644
--- a/image-recipe/configs/snippets/archipelago-https-app-proxies.conf
+++ b/image-recipe/configs/snippets/archipelago-https-app-proxies.conf
@@ -103,7 +103,7 @@ location /app/lnd/ {
     sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
 }
 location /app/onlyoffice/ {
-    proxy_pass http://127.0.0.1:9980/;
+    proxy_pass http://127.0.0.1:8044/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
@@ -161,7 +161,7 @@ location /app/mempool/ {
     sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
 }
 location /app/fedimint/ {
-    proxy_pass http://127.0.0.1:8175/;
+    proxy_pass http://127.0.0.1:8174/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
@@ -193,7 +193,8 @@ location /app/fedimint-gateway/ {
     sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
 }
 location /app/tailscale/ {
-    proxy_pass http://127.0.0.1:8240/;
+    # Tailscale: no web UI
+        return 503;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
@@ -284,7 +285,7 @@ location /app/indeedhub/ {
     sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
 }
 location /app/nginx-proxy-manager/ {
-    proxy_pass http://127.0.0.1:81/;
+    proxy_pass http://127.0.0.1:8181/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
diff --git a/neode-ui/src/views/AppSession.vue b/neode-ui/src/views/AppSession.vue
index dab2a666..40a2ab4b 100644
--- a/neode-ui/src/views/AppSession.vue
+++ b/neode-ui/src/views/AppSession.vue
@@ -291,7 +291,7 @@ const APP_PORTS: Record<string, number> = {
   'grafana':       3000,
   'searxng':       8888,
   'ollama':        11434,
-  'onlyoffice':    9980,
+  'onlyoffice':    8044,
   'penpot':        9001,
   'nextcloud':     8085,
   'vaultwarden':   8082,
@@ -300,11 +300,11 @@ const APP_PORTS: Record<string, number> = {
   'immich':        2283,
   'immich_server': 2283,
   'filebrowser':   8083,
-  'nginx-proxy-manager': 81,
+  'nginx-proxy-manager': 8181,
   'portainer':     9000,
   'uptime-kuma':   3001,
-  'tailscale':     8240,
-  'fedimint':      8175,
+  'fedimint':      8174,
+  'fedimintd':     8174,
   'fedimint-gateway': 8176,
   'nostr-rs-relay': 18081,
   'indeedhub':     7777,
@@ -330,6 +330,7 @@ const HTTPS_PROXY_PATHS: Record<string, string> = {
   'mempool-web': '/app/mempool/',
   'archy-mempool-web': '/app/mempool/',
   'fedimint': '/app/fedimint/',
+  'fedimintd': '/app/fedimint/',
   'fedimint-gateway': '/app/fedimint-gateway/',
   'jellyfin': '/app/jellyfin/',
   'searxng': '/app/searxng/',
@@ -338,7 +339,12 @@ const HTTPS_PROXY_PATHS: Record<string, string> = {
   'onlyoffice': '/app/onlyoffice/',
   'immich': '/app/immich/',
   'immich_server': '/app/immich/',
-  'tailscale': '/app/tailscale/',
+  'portainer': '/app/portainer/',
+  'nginx-proxy-manager': '/app/nginx-proxy-manager/',
+  'uptime-kuma': '/app/uptime-kuma/',
+  'homeassistant': '/app/homeassistant/',
+  'vaultwarden': '/app/vaultwarden/',
+  'photoprism': '/app/photoprism/',
   'endurain': '/app/endurain/',
   'dwn': '/app/dwn/',
 }
@@ -368,14 +374,17 @@ const appTitle = computed(() => APP_TITLES[appId.value] || appId.value.replace(/
 
 /** Apps that set X-Frame-Options and MUST open in a new tab (can't iframe) */
 const NEW_TAB_APPS = new Set([
-  'btcpay-server',   // X-Frame-Options: DENY
-  'grafana',         // X-Frame-Options: deny
-  'photoprism',      // X-Frame-Options: DENY
-  'homeassistant',   // X-Frame-Options: SAMEORIGIN
-  'vaultwarden',     // X-Frame-Options: SAMEORIGIN
-  'nextcloud',       // X-Frame-Options: SAMEORIGIN
-  'uptime-kuma',     // X-Frame-Options: SAMEORIGIN
-  'penpot',          // Not reachable / blocks iframe
+  'btcpay-server',      // X-Frame-Options: DENY
+  'grafana',            // X-Frame-Options: deny
+  'photoprism',         // X-Frame-Options: DENY
+  'homeassistant',      // X-Frame-Options: SAMEORIGIN
+  'vaultwarden',        // X-Frame-Options: SAMEORIGIN
+  'nextcloud',          // X-Frame-Options: SAMEORIGIN
+  'uptime-kuma',        // X-Frame-Options: SAMEORIGIN
+  'penpot',             // Blocks iframe
+  'portainer',          // X-Frame-Options: deny
+  'onlyoffice',         // X-Frame-Options: SAMEORIGIN
+  'nginx-proxy-manager', // X-Frame-Options blocks
 ])
 
 const mustOpenNewTab = computed(() => NEW_TAB_APPS.has(appId.value))