diff --git a/docker-compose.yml b/docker-compose.yml
index 256c405..67b2e33 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,12 +50,13 @@ services:
       start_period: 20s
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.tmflow-api.rule=Host(`tieflow.tielogic.xyz`) && (PathPrefix(`/api/`) || PathPrefix(`/uploads/`))"
+      - "traefik.http.routers.tmflow-api.rule=Host(`${APP_DOMAIN:?manca APP_DOMAIN}`) && PathPrefix(`/api/`)"
       - "traefik.http.routers.tmflow-api.entrypoints=web,websecure"
       - "traefik.http.routers.tmflow-api.tls=true"
       - "traefik.http.routers.tmflow-api.tls.certresolver=mytlschallenge"
       - "traefik.http.routers.tmflow-api.priority=100"
       - "traefik.http.services.tmflow-api.loadbalancer.server.port=8000"
+      - "traefik.http.routers.tmflow-api.middlewares=tmflow-headers"
     networks:
       - tmflow-net
       - traefik-net
@@ -99,19 +100,20 @@ services:
       start_period: 20s
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.tmflow-web.rule=Host(`tieflow.tielogic.xyz`)"
+      - "traefik.http.routers.tmflow-web.rule=Host(`${APP_DOMAIN:?manca APP_DOMAIN}`)"
       - "traefik.http.routers.tmflow-web.entrypoints=web,websecure"
       - "traefik.http.routers.tmflow-web.tls=true"
       - "traefik.http.routers.tmflow-web.tls.certresolver=mytlschallenge"
       - "traefik.http.routers.tmflow-web.priority=10"
       - "traefik.http.services.tmflow-web.loadbalancer.server.port=5000"
-      - "traefik.http.middlewares.tmflow-headers.headers.SSLRedirect=true"
-      - "traefik.http.middlewares.tmflow-headers.headers.STSSeconds=315360000"
-      - "traefik.http.middlewares.tmflow-headers.headers.browserXSSFilter=true"
+      # Traefik v3: SSLRedirect e browserXSSFilter non ci sono più (SSL redirect
+      # si fa a livello di entrypoint, l'XSS Auditor del browser non esiste più).
+      - "traefik.http.middlewares.tmflow-headers.headers.stsSeconds=315360000"
       - "traefik.http.middlewares.tmflow-headers.headers.contentTypeNosniff=true"
       - "traefik.http.middlewares.tmflow-headers.headers.forceSTSHeader=true"
       - "traefik.http.middlewares.tmflow-headers.headers.STSIncludeSubdomains=true"
       - "traefik.http.middlewares.tmflow-headers.headers.STSPreload=true"
+      - "traefik.http.middlewares.tmflow-headers.headers.frameDeny=true"
       - "traefik.http.routers.tmflow-web.middlewares=tmflow-headers"
     networks:
       - tmflow-net