diff --git a/compose.prod.yml b/compose.prod.yml
index 17753de..0c226a3 100644
--- a/compose.prod.yml
+++ b/compose.prod.yml
@@ -31,6 +31,12 @@ services:
       # (STORAGE_PUBLIC_URL) — without CORS allowed for that origin, the browser
       # blocks the request. Restricted to the app's own origin, not "*".
       MINIO_API_CORS_ALLOW_ORIGIN: ${BETTER_AUTH_URL}
+    ports:
+      # Published so the browser can reach MinIO directly for presigned
+      # up/downloads — same pattern as `web`'s ${WEB_PORT}: your Traefik LXC
+      # routes a (sub)domain to <this-lxc-ip>:${STORAGE_PORT}, and that public
+      # URL is what STORAGE_PUBLIC_URL must be set to.
+      - "${STORAGE_PORT:-9000}:9000"
     volumes:
       - minio_data:/data
     command: server /data --console-address ":9001"