diff --git a/apps/agenstra/backend-agent-controller/.start-containers.env.example b/apps/agenstra/backend-agent-controller/.start-containers.env.example
index 7a1c43e14..bdf3cb3f7 100644
--- a/apps/agenstra/backend-agent-controller/.start-containers.env.example
+++ b/apps/agenstra/backend-agent-controller/.start-containers.env.example
@@ -1,9 +1,19 @@
+# Local-only defaults for the container stack. Replace placeholders before exposing it.
+HOST=0.0.0.0
+PORT=3100
+NODE_ENV=development
+DB_HOST=postgres
+DB_PORT=5432
+DB_USERNAME=postgres
+DB_PASSWORD=postgres
+DB_DATABASE=postgres
+
 # Environment variables for the provisioning providers
 HETZNER_API_TOKEN=
 DIGITALOCEAN_API_TOKEN=
 
 # Environment variables for encryption
-ENCRYPTION_KEY=
+ENCRYPTION_KEY=MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=
 
 # Client workspace endpoint SSRF guardrails (agent-manager base URLs stored per client)
 # Production: set CLIENT_ENDPOINT_ALLOWED_HOSTS to comma-separated hostnames or * (see docs).
@@ -13,9 +23,10 @@ ENCRYPTION_KEY=
 # CLIENT_ENDPOINT_TLS_REJECT_UNAUTHORIZED=true
 
 # CORS (HTTP uses CORS_ORIGIN; Socket.IO/VNC resolve WEBSOCKET_CORS_ORIGIN → CORS_ORIGIN → *)
-# Example: CORS_ORIGIN=http://localhost:4200
-CORS_ORIGIN=
+# Example: CORS_ORIGIN=http://localhost:4100
+CORS_ORIGIN=http://localhost:4100
 WEBSOCKET_CORS_ORIGIN=
+WEBSOCKET_NAMESPACE=socket/clients
 
 # Environment variables for the authentication method
 # AUTHENTICATION_METHOD: api-key | keycloak | users (default: api-key when STATIC_API_KEY set, else keycloak)
@@ -30,18 +41,20 @@ DISABLE_SIGNUP=false
 DISABLE_FORCE_LOGIN_2FA=false
 
 # Environment variables for static API key authentication (when AUTHENTICATION_METHOD=api-key)
-STATIC_API_KEY=
+STATIC_API_KEY=local-development-agent-controller-api-key
 
 # Environment variables for users authentication (when AUTHENTICATION_METHOD=users)
-JWT_SECRET=
+JWT_SECRET=local-development-agent-controller-jwt-secret-change-before-deployment
 # TOTP issuer shown in authenticator apps (otpauth label). Defaults to Forepath when unset.
 PRODUCT_NAME=Agenstra
 
 # SMTP configuration (MailHog when using docker-compose)
 # SMTP_HOST=mailhog and SMTP_PORT=1025 are used by default when running in Docker
 # For production SMTP: set SMTP_USER and SMTP_PASSWORD; use port 465 for SMTPS
-SMTP_HOST=
-SMTP_PORT=
+SMTP_HOST=mailhog
+SMTP_PORT=1025
+SMTP_HOST_PORT=1025
+MAILHOG_HOST_PORT=8025
 SMTP_USER=
 SMTP_PASSWORD=
 EMAIL_FROM=noreply@localhost
@@ -84,9 +97,9 @@ SEARCH_REINDEX_BATCH_SIZE=100
 OTEL_ENABLED=false
 OTEL_USERNAME=
 OTEL_PASSWORD=
-# OTEL_METRICS_PATH=/otel/metrics
-# OTEL_SERVICE_NAME=
-# OTEL_EXPORTER_OTLP_ENDPOINT=
+OTEL_METRICS_PATH=/otel/metrics
+OTEL_SERVICE_NAME=
+OTEL_EXPORTER_OTLP_ENDPOINT=
 
 # Application version and update checks
 VERSION=
@@ -97,4 +110,39 @@ UPDATE_CHECK_TIMEZONE=Europe/Berlin
 
 # MCP authentication callback security
 MCP_OAUTH_PUBLIC_BASE_URL=http://localhost:3100
-MCP_OAUTH_CALLBACK_SECRET=
+MCP_OAUTH_CALLBACK_SECRET=local-development-mcp-callback-secret-change-before-deployment
+
+# Remaining explicit Compose defaults
+AUTO_ENRICH_ENABLED_GLOBAL=true
+AUTO_ENRICH_VECTOR_ENABLED=true
+AUTO_ENRICH_MAX_SECTIONS=6
+AUTO_ENRICH_MAX_CHARS=12000
+AUTO_ENRICH_VECTOR_TOP_K=20
+AUTO_ENRICH_VECTOR_MAX_COSINE_DISTANCE=1
+KNOWLEDGE_EMBEDDINGS_REINDEX_INTERVAL_MS=3600000
+CONTEXT_IMPORT_SCHEDULER_INTERVAL_MS=120000
+CONTEXT_IMPORT_SCHEDULER_CONFIG_BATCH=3
+CONTEXT_IMPORT_ITEM_BUDGET=25
+FILTER_RULES_SYNC_INTERVAL_MS=30000
+FILTER_RULES_SYNC_BATCH_SIZE=10
+AUTONOMOUS_TICKET_SCHEDULER_INTERVAL_MS=60000
+AUTONOMOUS_TICKET_SCHEDULER_BATCH_SIZE=5
+DYNAMIC_PROVISIONING_PROVIDERS=
+DYNAMIC_CONTEXT_IMPORT_PROVIDERS=
+DYNAMIC_PROVIDERS_FAIL_FAST=false
+DYNAMIC_PROVIDER_PLUGIN_PATH=
+DYNAMIC_PROVIDER_PLUGIN_INSTALL=
+CLIENT_ENDPOINT_ALLOWED_HOSTS=
+CLIENT_ENDPOINT_ALLOW_INSECURE_HTTP=false
+CLIENT_ENDPOINT_ALLOW_INTERNAL_HOST=false
+CLIENT_ENDPOINT_TLS_REJECT_UNAUTHORIZED=true
+KEYCLOAK_SERVER_URL=
+KEYCLOAK_AUTH_SERVER_URL=
+KEYCLOAK_REALM=
+KEYCLOAK_CLIENT_ID=
+KEYCLOAK_CLIENT_SECRET=
+KEYCLOAK_TOKEN_VALIDATION=online
+OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m
+RATE_LIMIT_ENABLED=
+RATE_LIMIT_TTL=60
+RATE_LIMIT_LIMIT=100
diff --git a/apps/agenstra/backend-agent-controller/README.md b/apps/agenstra/backend-agent-controller/README.md
index 9a73d0eb7..e8435609f 100644
--- a/apps/agenstra/backend-agent-controller/README.md
+++ b/apps/agenstra/backend-agent-controller/README.md
@@ -192,7 +192,7 @@ CORS_ORIGIN="https://agenstra.com,https://app.agenstra.com"
 
 # Development: Allow all origins (default, no configuration needed)
 # Or restrict to specific origins:
-CORS_ORIGIN="http://localhost:4200,http://localhost:3000"
+CORS_ORIGIN="http://localhost:4100"
 ```
 
 ## Environment Variables
@@ -276,8 +276,9 @@ nx docker:api agenstra-backend-agent-controller
 
 ```bash
 # Run with docker-compose (recommended)
-cd apps/agenstra-backend-agent-controller
-docker compose up -d
+cd apps/agenstra/backend-agent-controller
+cp .start-containers.env.example .start-containers.env
+docker compose --env-file .start-containers.env up -d
 
 # Or run directly
 docker run \
diff --git a/apps/agenstra/backend-agent-controller/docker-compose.yaml b/apps/agenstra/backend-agent-controller/docker-compose.yaml
index 56ff092cb..9e3c41ff3 100644
--- a/apps/agenstra/backend-agent-controller/docker-compose.yaml
+++ b/apps/agenstra/backend-agent-controller/docker-compose.yaml
@@ -54,7 +54,7 @@ x-backend-agent-controller-environment: &backend-agent-controller-environment
   DISABLE_FORCE_LOGIN_2FA: ${DISABLE_FORCE_LOGIN_2FA:-false}
   STATIC_API_KEY: ${STATIC_API_KEY:-}
   ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
-  CORS_ORIGIN: ${CORS_ORIGIN:-}
+  CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:4100}
   RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-}
   RATE_LIMIT_TTL: ${RATE_LIMIT_TTL:-60}
   RATE_LIMIT_LIMIT: ${RATE_LIMIT_LIMIT:-100}
@@ -255,8 +255,8 @@ services:
     image: mailhog/mailhog:latest
     container_name: agent-controller-mailhog
     ports:
-      - '${SMTP_PORT:-1025}:${SMTP_PORT:-1025}'
-      - '${MAILHOG_PORT:-8025}:${MAILHOG_PORT:-8025}'
+      - '${SMTP_HOST_PORT:-1025}:${SMTP_PORT:-1025}'
+      - '${MAILHOG_HOST_PORT:-8025}:8025'
     networks:
       - agent-controller-network
     restart: unless-stopped
diff --git a/apps/agenstra/backend-agent-controller/project.json b/apps/agenstra/backend-agent-controller/project.json
index 7680ea5df..69e3beeef 100644
--- a/apps/agenstra/backend-agent-controller/project.json
+++ b/apps/agenstra/backend-agent-controller/project.json
@@ -168,7 +168,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/agenstra/backend-agent-controller",
-        "command": "docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-backend-agent-controller"
+        "command": "docker compose --env-file .start-containers.env up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-backend-agent-controller"
       }
     },
     "openapi-client-js": {
diff --git a/apps/agenstra/backend-agent-manager/.start-containers.env.example b/apps/agenstra/backend-agent-manager/.start-containers.env.example
index fa9cb2238..e7dd45c3a 100644
--- a/apps/agenstra/backend-agent-manager/.start-containers.env.example
+++ b/apps/agenstra/backend-agent-manager/.start-containers.env.example
@@ -1,3 +1,14 @@
+# Local-only defaults for the container stack. Replace placeholders before exposing it.
+HOST=0.0.0.0
+PORT=3000
+NODE_ENV=development
+WEBSOCKET_NAMESPACE=socket/agents
+DB_HOST=postgres
+DB_PORT=5432
+DB_USERNAME=postgres
+DB_PASSWORD=postgres
+DB_DATABASE=postgres
+
 # Environment variables for the cursor-agent
 CURSOR_API_KEY=
 
@@ -8,7 +19,7 @@ GIT_TOKEN=
 GIT_PRIVATE_KEY=
 
 # Environment variables for encryption (base64-encoded 32-byte AES-256 key)
-ENCRYPTION_KEY=
+ENCRYPTION_KEY=MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=
 
 # Worker image (must run `opencode serve`). Rebuild locally after Dockerfile.worker changes:
 #   docker build -f apps/agenstra/backend-agent-manager/Dockerfile.worker \
@@ -18,17 +29,17 @@ AGENT_DEFAULT_IMAGE=ghcr.io/forepath/agenstra-manager-worker:latest
 OPENCODE_AGENT_DOCKER_IMAGE=ghcr.io/forepath/agenstra-manager-worker:latest
 
 # CORS (HTTP uses CORS_ORIGIN; Socket.IO/VNC resolve WEBSOCKET_CORS_ORIGIN → CORS_ORIGIN → *)
-# Example: CORS_ORIGIN=http://localhost:4200
-CORS_ORIGIN=
+# Example: CORS_ORIGIN=http://localhost:4100
+CORS_ORIGIN=http://localhost:4100
 WEBSOCKET_CORS_ORIGIN=
 
 # Environment variables for static API key authentication
 # If STATIC_API_KEY is set, API key authentication is used (no Keycloak fallback)
 # If STATIC_API_KEY is not set, Keycloak authentication is used
-STATIC_API_KEY=
+STATIC_API_KEY=local-development-agent-manager-api-key
 
 # Environment variables for users authentication (when AUTHENTICATION_METHOD=users)
-JWT_SECRET=
+JWT_SECRET=local-development-agent-manager-jwt-secret-change-before-deployment
 
 # Application version (reported by GET /api/instance-status)
 VERSION=
@@ -39,6 +50,25 @@ AGENT_MANAGER_ROLE=api
 OTEL_ENABLED=false
 OTEL_USERNAME=
 OTEL_PASSWORD=
-# OTEL_METRICS_PATH=/otel/metrics
-# OTEL_SERVICE_NAME=
-# OTEL_EXPORTER_OTLP_ENDPOINT=
+OTEL_METRICS_PATH=/otel/metrics
+OTEL_SERVICE_NAME=
+OTEL_EXPORTER_OTLP_ENDPOINT=
+
+# Remaining explicit Compose defaults
+AGENT_DOCKER_NETWORK=agent-manager-network
+DOCKER_HOST_GATEWAY=host.docker.internal
+DYNAMIC_PIPELINE_PROVIDERS=
+DYNAMIC_CHAT_FILTERS=
+DYNAMIC_PROVIDERS_FAIL_FAST=false
+DYNAMIC_PROVIDER_PLUGIN_PATH=
+DYNAMIC_PROVIDER_PLUGIN_INSTALL=
+GIT_PASSWORD=
+KEYCLOAK_SERVER_URL=
+KEYCLOAK_AUTH_SERVER_URL=
+KEYCLOAK_REALM=
+KEYCLOAK_CLIENT_ID=
+KEYCLOAK_CLIENT_SECRET=
+KEYCLOAK_TOKEN_VALIDATION=online
+RATE_LIMIT_ENABLED=
+RATE_LIMIT_TTL=60
+RATE_LIMIT_LIMIT=100
diff --git a/apps/agenstra/backend-agent-manager/README.md b/apps/agenstra/backend-agent-manager/README.md
index 6f06c0b30..d99df57e0 100644
--- a/apps/agenstra/backend-agent-manager/README.md
+++ b/apps/agenstra/backend-agent-manager/README.md
@@ -192,7 +192,7 @@ CORS_ORIGIN="https://agenstra.com,https://app.agenstra.com"
 
 # Development: Allow all origins (default, no configuration needed)
 # Or restrict to specific origins:
-CORS_ORIGIN="http://localhost:4200,http://localhost:3000"
+CORS_ORIGIN="http://localhost:4100"
 ```
 
 ## Environment Variables
@@ -246,8 +246,9 @@ When running the API container, you must mount the Docker socket to enable Docke
 
 ```bash
 # Run with docker-compose (recommended)
-cd apps/agenstra-backend-agent-manager
-docker compose up -d
+cd apps/agenstra/backend-agent-manager
+cp .start-containers.env.example .start-containers.env
+docker compose --env-file .start-containers.env up -d
 
 # Or run directly with Docker socket mount
 docker run -v /var/run/docker.sock:/var/run/docker.sock \
diff --git a/apps/agenstra/backend-agent-manager/docker-compose.yaml b/apps/agenstra/backend-agent-manager/docker-compose.yaml
index 83c424243..32458fb25 100644
--- a/apps/agenstra/backend-agent-manager/docker-compose.yaml
+++ b/apps/agenstra/backend-agent-manager/docker-compose.yaml
@@ -57,7 +57,7 @@ services:
       # CORS configuration (comma-separated list of allowed origins)
       # In production: CORS is disabled by default. Set CORS_ORIGIN to allow specific origins.
       # In development: CORS allows all origins by default.
-      CORS_ORIGIN: ${CORS_ORIGIN:-}
+      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:4100}
       # Rate limiting configuration
       RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-}
       RATE_LIMIT_TTL: ${RATE_LIMIT_TTL:-60}
diff --git a/apps/agenstra/backend-agent-manager/project.json b/apps/agenstra/backend-agent-manager/project.json
index a4fcdc255..b41e0662e 100644
--- a/apps/agenstra/backend-agent-manager/project.json
+++ b/apps/agenstra/backend-agent-manager/project.json
@@ -179,7 +179,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/agenstra/backend-agent-manager",
-        "command": "docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-backend-agent-manager"
+        "command": "docker compose --env-file .start-containers.env up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-backend-agent-manager"
       }
     },
     "openapi-client-js": {
diff --git a/apps/agenstra/frontend-agent-console/Dockerfile.server b/apps/agenstra/frontend-agent-console/Dockerfile.server
index 9a4ba9a85..62baf4f16 100644
--- a/apps/agenstra/frontend-agent-console/Dockerfile.server
+++ b/apps/agenstra/frontend-agent-console/Dockerfile.server
@@ -4,9 +4,9 @@
 # Registry:   ghcr.io/forepath/agenstra-console-server
 # Base:       node:24.14.1-alpine
 # User:       node (APP_UID / APP_GID, default 1000)
-# Exposes:    4200 (Express static server)
+# Exposes:    4100 (Express static server)
 # Build:      npx nx run frontend-agent-console:server-container-image
-# Run:        nx docker:run agenstra-frontend-agent-console -p 4200:4200
+# Run:        nx docker:run agenstra-frontend-agent-console -p 4100:4100
 # Notes:      —
 # -----------------------------------------------------------------------------
 #
@@ -18,7 +18,7 @@ ARG VERSION=0.0.0
 ENV VERSION=${VERSION}
 
 ENV HOST=0.0.0.0
-ENV PORT=4200
+ENV PORT=4100
 
 WORKDIR /app
 
diff --git a/apps/agenstra/frontend-agent-console/docker-compose.yaml b/apps/agenstra/frontend-agent-console/docker-compose.yaml
index 52dfbe319..fb27366fc 100644
--- a/apps/agenstra/frontend-agent-console/docker-compose.yaml
+++ b/apps/agenstra/frontend-agent-console/docker-compose.yaml
@@ -6,13 +6,13 @@ services:
     environment:
       # Frontend server configuration
       HOST: ${HOST:-0.0.0.0}
-      PORT: ${PORT:-4200}
+      PORT: ${PORT:-4100}
       NODE_ENV: ${NODE_ENV:-production}
       DEFAULT_LOCALE: ${DEFAULT_LOCALE:-en}
       CSP_ENFORCE: ${CSP_ENFORCE:-true}
       CSP_CONNECT_SRC_EXTRA: ${CSP_CONNECT_SRC_EXTRA:-http://host.docker.internal:3100}
     ports:
-      - '${PORT:-4200}:${PORT:-4200}'
+      - '${PORT:-4100}:${PORT:-4100}'
     networks:
       - agent-console-network
     restart: unless-stopped
diff --git a/apps/agenstra/frontend-agent-console/project.json b/apps/agenstra/frontend-agent-console/project.json
index d81625828..c09b7ddde 100644
--- a/apps/agenstra/frontend-agent-console/project.json
+++ b/apps/agenstra/frontend-agent-console/project.json
@@ -116,7 +116,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4200
+        "port": 4100
       },
       "configurations": {
         "development": {
@@ -159,7 +159,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "agenstra-frontend-agent-console:build",
-        "port": 4200,
+        "port": 4100,
         "staticFilePath": "dist/apps/agenstra/frontend-agent-console/browser",
         "spa": true
       }
diff --git a/apps/agenstra/frontend-agent-console/src/server.ts b/apps/agenstra/frontend-agent-console/src/server.ts
index 9399029fe..adf07a2ec 100644
--- a/apps/agenstra/frontend-agent-console/src/server.ts
+++ b/apps/agenstra/frontend-agent-console/src/server.ts
@@ -17,7 +17,7 @@ import {
 import express from 'express';
 
 const app = express();
-const port = parseInt(process.env['PORT'] || '4200', 10);
+const port = parseInt(process.env['PORT'] || '4100', 10);
 
 app.use(createSecurityHeadersMiddleware());
 registerRuntimeConfigEndpoint(app);
diff --git a/apps/agenstra/frontend-billing-console/project.json b/apps/agenstra/frontend-billing-console/project.json
index 3b7624aee..03c10264e 100644
--- a/apps/agenstra/frontend-billing-console/project.json
+++ b/apps/agenstra/frontend-billing-console/project.json
@@ -121,7 +121,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4500
+        "port": 4103
       },
       "configurations": {
         "development": {
@@ -164,7 +164,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "agenstra-frontend-billing-console:build",
-        "port": 4500,
+        "port": 4103,
         "staticFilePath": "dist/apps/agenstra/frontend-billing-console/browser",
         "spa": true
       }
@@ -245,7 +245,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/decabill/frontend-billing-console",
-        "command": "BILLING_CONSOLE_SERVER_IMAGE=ghcr.io/forepath/agenstra-billing-console-server:latest BILLING_CONSOLE_SERVER_CONTAINER_NAME=agenstra-billing-console-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-frontend-billing-console"
+        "command": "PORT=4103 BILLING_CONSOLE_SERVER_IMAGE=ghcr.io/forepath/agenstra-billing-console-server:latest BILLING_CONSOLE_SERVER_CONTAINER_NAME=agenstra-billing-console-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-frontend-billing-console"
       }
     },
     "sbom": {
diff --git a/apps/agenstra/frontend-docs/project.json b/apps/agenstra/frontend-docs/project.json
index bbfc9f155..d223cd3e9 100644
--- a/apps/agenstra/frontend-docs/project.json
+++ b/apps/agenstra/frontend-docs/project.json
@@ -151,7 +151,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4400
+        "port": 4102
       },
       "configurations": {
         "production": {
@@ -194,7 +194,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "agenstra-frontend-docs:build",
-        "port": 4400,
+        "port": 4102,
         "staticFilePath": "dist/apps/agenstra/frontend-docs/browser",
         "spa": true
       }
@@ -248,7 +248,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/shared/frontend-docs",
-        "command": "DOCS_SERVER_IMAGE=ghcr.io/forepath/agenstra-docs-server:latest DOCS_SERVER_CONTAINER_NAME=agenstra-docs-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-frontend-docs"
+        "command": "PORT=4102 DOCS_SERVER_IMAGE=ghcr.io/forepath/agenstra-docs-server:latest DOCS_SERVER_CONTAINER_NAME=agenstra-docs-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-frontend-docs"
       }
     },
     "sbom": {
diff --git a/apps/agenstra/frontend-landingpage/Dockerfile.server b/apps/agenstra/frontend-landingpage/Dockerfile.server
index a0943dc3b..7383c93f9 100644
--- a/apps/agenstra/frontend-landingpage/Dockerfile.server
+++ b/apps/agenstra/frontend-landingpage/Dockerfile.server
@@ -4,9 +4,9 @@
 # Registry:   ghcr.io/forepath/agenstra-landingpage-server
 # Base:       node:24.14.1-alpine
 # User:       node (APP_UID / APP_GID, default 1000)
-# Exposes:    4000 (Express static server)
+# Exposes:    4101 (Express static server)
 # Build:      npx nx run agenstra-frontend-landingpage:server-container-image
-# Run:        nx docker:run agenstra-frontend-landingpage -p 4000:4000
+# Run:        nx docker:run agenstra-frontend-landingpage -p 4101:4101
 # Notes:      —
 # -----------------------------------------------------------------------------
 #
@@ -18,7 +18,7 @@ ARG VERSION=0.0.0
 ENV VERSION=${VERSION}
 
 ENV HOST=0.0.0.0
-ENV PORT=4000
+ENV PORT=4101
 
 WORKDIR /app
 
diff --git a/apps/agenstra/frontend-landingpage/docker-compose.yaml b/apps/agenstra/frontend-landingpage/docker-compose.yaml
index e667d56bf..135c96902 100644
--- a/apps/agenstra/frontend-landingpage/docker-compose.yaml
+++ b/apps/agenstra/frontend-landingpage/docker-compose.yaml
@@ -6,11 +6,11 @@ services:
     environment:
       # Frontend server configuration
       HOST: ${HOST:-0.0.0.0}
-      PORT: ${PORT:-4200}
+      PORT: ${PORT:-4101}
       NODE_ENV: ${NODE_ENV:-production}
       DEFAULT_LOCALE: ${DEFAULT_LOCALE:-en}
     ports:
-      - '${PORT:-4200}:${PORT:-4200}'
+      - '${PORT:-4101}:${PORT:-4101}'
     networks:
       - landingpage-network
     restart: unless-stopped
diff --git a/apps/agenstra/frontend-landingpage/project.json b/apps/agenstra/frontend-landingpage/project.json
index 00058eda7..e48663db0 100644
--- a/apps/agenstra/frontend-landingpage/project.json
+++ b/apps/agenstra/frontend-landingpage/project.json
@@ -103,7 +103,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4300
+        "port": 4101
       },
       "configurations": {
         "production": {
@@ -146,7 +146,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "agenstra-frontend-landingpage:build",
-        "port": 4300,
+        "port": 4101,
         "staticFilePath": "dist/apps/agenstra/frontend-landingpage/browser",
         "spa": true
       }
diff --git a/apps/agenstra/frontend-landingpage/src/server.mjs b/apps/agenstra/frontend-landingpage/src/server.mjs
index d01283958..7247dbcd1 100644
--- a/apps/agenstra/frontend-landingpage/src/server.mjs
+++ b/apps/agenstra/frontend-landingpage/src/server.mjs
@@ -69,7 +69,7 @@ const server = createServer(async (req, res) => {
   }
 });
 
-const port = process.env['PORT'] || 4000;
+const port = process.env['PORT'] || 4101;
 
 server.listen(port, () => {
   console.log(`Delegating server running on http://localhost:${port}`);
diff --git a/apps/agenstra/frontend-landingpage/src/server.ts b/apps/agenstra/frontend-landingpage/src/server.ts
index 0f062afec..888d80d2a 100644
--- a/apps/agenstra/frontend-landingpage/src/server.ts
+++ b/apps/agenstra/frontend-landingpage/src/server.ts
@@ -15,10 +15,10 @@ const { app, warmStaticCache } = createSsrExpressApp({
 
 /**
  * Start the server if this module is the main entry point.
- * The server listens on the port defined by the `PORT` environment variable, or defaults to 4000.
+ * The server listens on the port defined by the `PORT` environment variable, or defaults to 4101.
  */
 if (isMainModule(import.meta.url)) {
-  const port = parseInt(process.env['PORT'] || '4000', 10);
+  const port = parseInt(process.env['PORT'] || '4101', 10);
 
   warmStaticCache()
     .then(() => {
diff --git a/apps/decabill/backend-billing-manager/.start-containers.env.example b/apps/decabill/backend-billing-manager/.start-containers.env.example
index 16374f5da..8e7c81874 100644
--- a/apps/decabill/backend-billing-manager/.start-containers.env.example
+++ b/apps/decabill/backend-billing-manager/.start-containers.env.example
@@ -1,18 +1,24 @@
+# Local-only defaults for the container stack. Replace placeholders before exposing it.
+# Application and database ports
+HOST=0.0.0.0
+PORT=3200
+NODE_ENV=development
+
 # Database configuration
-DB_HOST=localhost
+DB_HOST=postgres
 DB_PORT=5432
 DB_USERNAME=postgres
 DB_PASSWORD=postgres
-DB_DATABASE=billing
+DB_DATABASE=postgres
 
 # CORS configuration (comma-separated list of allowed origins)
-# Example: CORS_ORIGIN=http://localhost:4200,http://localhost:4201
+# Example: CORS_ORIGIN=http://localhost:4103,http://localhost:4202,http://localhost:4301
 # Socket.IO resolves WEBSOCKET_CORS_ORIGIN → CORS_ORIGIN → *
-CORS_ORIGIN=
+CORS_ORIGIN=http://localhost:4103,http://localhost:4202,http://localhost:4301
 WEBSOCKET_CORS_ORIGIN=
 
 # Encryption key for sensitive data (base64 encoded)
-ENCRYPTION_KEY=
+ENCRYPTION_KEY=MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=
 
 # Authentication method: api-key | keycloak | users
 # - api-key: Static API key auth (requires STATIC_API_KEY)
@@ -26,10 +32,10 @@ DISABLE_SIGNUP=false
 DISABLE_FORCE_LOGIN_2FA=false
 
 # Environment variables for static API key authentication (when AUTHENTICATION_METHOD=api-key)
-STATIC_API_KEY=
+STATIC_API_KEY=local-development-decabill-api-key
 
 # Environment variables for users authentication (when AUTHENTICATION_METHOD=users)
-JWT_SECRET=
+JWT_SECRET=local-development-decabill-jwt-secret-change-before-deployment
 # TOTP issuer shown in authenticator apps (otpauth label). Defaults to Forepath when unset.
 PRODUCT_NAME=Decabill
 
@@ -63,14 +69,16 @@ FILE_STORAGE_PROVIDER=local
 FILE_STORAGE_LAYOUT_MIGRATION_ENABLED=true
 FILE_STORAGE_LAYOUT_DUAL_READ_ENABLED=true
 # Global HMAC secret for billing_stored_files signatures (required in production)
-BILLING_FILE_SIGNING_SECRET=
+BILLING_FILE_SIGNING_SECRET=0000000000000000000000000000000000000000000000000000000000000000
 # Deprecated legacy roots (migration sources only)
 BILLING_INVOICE_PDF_STORAGE_PATH=/data/invoices
 
 # SMTP / transactional email (MailHog when using docker-compose)
 # SMTP_HOST=mailhog and SMTP_PORT=1025 are used by default when running in Docker
-SMTP_HOST=
-SMTP_PORT=
+SMTP_HOST=mailhog
+SMTP_PORT=1025
+SMTP_HOST_PORT=1026
+MAILHOG_HOST_PORT=8026
 SMTP_USER=
 SMTP_PASSWORD=
 EMAIL_FROM=noreply@localhost
@@ -101,12 +109,12 @@ BILLING_DEFAULT_PAYMENT_PROCESSOR=stripe
 STRIPE_SECRET_KEY=
 STRIPE_WEBHOOK_SECRET=
 STRIPE_CHECKOUT_FRAUD_PROTECTION_ENABLED=true
-STRIPE_CHECKOUT_SUCCESS_URL=http://localhost:4500/invoices?payment=success
-STRIPE_CHECKOUT_CANCEL_URL=http://localhost:4500/invoices?payment=cancel
+STRIPE_CHECKOUT_SUCCESS_URL=http://localhost:4202/invoices?payment=success
+STRIPE_CHECKOUT_CANCEL_URL=http://localhost:4202/invoices?payment=cancel
 
 # Billing console base URLs for Stripe return redirects (tenant-aware)
 # Default tenant uses BILLING_FRONTEND_URL; per-tenant overrides use TENANT_FRONTEND_URLS.
-BILLING_FRONTEND_URL=http://localhost:4500
+BILLING_FRONTEND_URL=http://localhost:4202
 # Example: TENANT_FRONTEND_URLS=acme=https://billing.acme.com,corp=https://billing.corp.example
 TENANT_FRONTEND_URLS=
 
@@ -148,9 +156,9 @@ REDIS_HOST_PORT=6380
 
 # OpenSearch (search indexes)
 OPENSEARCH_ENABLED=true
-OPENSEARCH_HOST=localhost
-OPENSEARCH_PORT=9201
-OPENSEARCH_NODE=http://localhost:9201
+OPENSEARCH_HOST=opensearch
+OPENSEARCH_PORT=9200
+OPENSEARCH_NODE=http://opensearch:9200
 OPENSEARCH_USERNAME=
 OPENSEARCH_PASSWORD=
 OPENSEARCH_INDEX_PREFIX=decabill
@@ -161,7 +169,7 @@ QUEUE_WORKER_CONCURRENCY=5
 QUEUE_BULL_BOARD_ENABLED=true
 QUEUE_BULL_BOARD_PATH=/admin/queues
 QUEUE_BULL_BOARD_USERNAME=admin
-QUEUE_BULL_BOARD_PASSWORD=bullmq
+QUEUE_BULL_BOARD_PASSWORD=local-development-bull-board-password
 
 # Multi-tenancy (optional)
 # Comma-separated tenant ids allowed for X-Tenant requests (includes "default" unless disabled below).
@@ -191,3 +199,28 @@ INSTANCE_ID=
 UPDATE_CHECK_GITHUB_TOKEN=
 UPDATE_CHECK_CRON=0 0 * * *
 UPDATE_CHECK_TIMEZONE=Europe/Berlin
+
+# Remaining explicit Compose defaults
+WEBSOCKET_NAMESPACE=socket/billing
+DYNAMIC_PAYMENT_PROCESSORS=
+DYNAMIC_BILLING_PROVIDER_METADATA=
+DYNAMIC_PROVIDERS_FAIL_FAST=false
+DYNAMIC_PROVIDER_PLUGIN_PATH=
+DYNAMIC_PROVIDER_PLUGIN_INSTALL=
+FILE_STORAGE_LEGACY_MIGRATION_ENABLED=true
+FILE_STORAGE_S3_BUCKET=
+FILE_STORAGE_S3_ACCESS_KEY_ID=
+FILE_STORAGE_S3_SECRET_ACCESS_KEY=
+FILE_STORAGE_S3_REGION=auto
+FILE_STORAGE_S3_ENDPOINT=
+FILE_STORAGE_S3_FORCE_PATH_STYLE=
+FILE_STORAGE_S3_KEY_PREFIX=
+OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m
+RATE_LIMIT_ENABLED=
+RATE_LIMIT_TTL=60
+RATE_LIMIT_LIMIT=100
+STATUS_POLL_INTERVAL=15000
+TENANTS_SHARED_NUMBERS=true
+OTEL_METRICS_PATH=/otel/metrics
+OTEL_SERVICE_NAME=
+OTEL_EXPORTER_OTLP_ENDPOINT=
diff --git a/apps/decabill/backend-billing-manager/docker-compose.yaml b/apps/decabill/backend-billing-manager/docker-compose.yaml
index 99ec2bd3c..2719a43c4 100644
--- a/apps/decabill/backend-billing-manager/docker-compose.yaml
+++ b/apps/decabill/backend-billing-manager/docker-compose.yaml
@@ -34,7 +34,7 @@ x-backend-billing-manager-environment: &backend-billing-manager-environment
   DISABLE_FORCE_LOGIN_2FA: ${DISABLE_FORCE_LOGIN_2FA:-false}
   STATIC_API_KEY: ${STATIC_API_KEY:-}
   ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
-  CORS_ORIGIN: ${CORS_ORIGIN:-}
+  CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:4103,http://localhost:4202,http://localhost:4301}
   RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-}
   RATE_LIMIT_TTL: ${RATE_LIMIT_TTL:-60}
   RATE_LIMIT_LIMIT: ${RATE_LIMIT_LIMIT:-100}
@@ -96,15 +96,15 @@ x-backend-billing-manager-environment: &backend-billing-manager-environment
   STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
   STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
   STRIPE_CHECKOUT_FRAUD_PROTECTION_ENABLED: ${STRIPE_CHECKOUT_FRAUD_PROTECTION_ENABLED:-true}
-  STRIPE_CHECKOUT_SUCCESS_URL: ${STRIPE_CHECKOUT_SUCCESS_URL:-http://localhost:4500/invoices?payment=success}
-  STRIPE_CHECKOUT_CANCEL_URL: ${STRIPE_CHECKOUT_CANCEL_URL:-http://localhost:4500/invoices?payment=cancel}
+  STRIPE_CHECKOUT_SUCCESS_URL: ${STRIPE_CHECKOUT_SUCCESS_URL:-http://localhost:4202/invoices?payment=success}
+  STRIPE_CHECKOUT_CANCEL_URL: ${STRIPE_CHECKOUT_CANCEL_URL:-http://localhost:4202/invoices?payment=cancel}
   # Dynamic provider plugins (baked-in runtime deps and/or mounted plugin path)
   DYNAMIC_PAYMENT_PROCESSORS: ${DYNAMIC_PAYMENT_PROCESSORS:-}
   DYNAMIC_BILLING_PROVIDER_METADATA: ${DYNAMIC_BILLING_PROVIDER_METADATA:-}
   DYNAMIC_PROVIDERS_FAIL_FAST: ${DYNAMIC_PROVIDERS_FAIL_FAST:-false}
   DYNAMIC_PROVIDER_PLUGIN_PATH: ${DYNAMIC_PROVIDER_PLUGIN_PATH:-}
   DYNAMIC_PROVIDER_PLUGIN_INSTALL: ${DYNAMIC_PROVIDER_PLUGIN_INSTALL:-}
-  BILLING_FRONTEND_URL: ${BILLING_FRONTEND_URL:-http://localhost:4500}
+  BILLING_FRONTEND_URL: ${BILLING_FRONTEND_URL:-http://localhost:4202}
   TENANT_FRONTEND_URLS: ${TENANT_FRONTEND_URLS:-}
   BILLING_SCHEDULER_INTERVAL: ${BILLING_SCHEDULER_INTERVAL:-60000}
   BILLING_SCHEDULER_BATCH_SIZE: ${BILLING_SCHEDULER_BATCH_SIZE:-100}
@@ -301,8 +301,8 @@ services:
     image: mailhog/mailhog:latest
     container_name: billing-manager-mailhog
     ports:
-      - '${SMTP_PORT:-1026}:${SMTP_PORT:-1025}'
-      - '${MAILHOG_PORT:-8026}:${MAILHOG_PORT:-8025}'
+      - '${SMTP_HOST_PORT:-1026}:${SMTP_PORT:-1025}'
+      - '${MAILHOG_HOST_PORT:-8026}:8025'
     networks:
       - billing-network
     restart: unless-stopped
diff --git a/apps/decabill/backend-billing-manager/project.json b/apps/decabill/backend-billing-manager/project.json
index b127cd808..2c86d71f7 100644
--- a/apps/decabill/backend-billing-manager/project.json
+++ b/apps/decabill/backend-billing-manager/project.json
@@ -181,7 +181,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/decabill/backend-billing-manager",
-        "command": "docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=decabill-backend-billing-manager"
+        "command": "docker compose --env-file .start-containers.env up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=decabill-backend-billing-manager"
       }
     },
     "openapi-client-js": {
diff --git a/apps/decabill/frontend-billing-console/Dockerfile.server b/apps/decabill/frontend-billing-console/Dockerfile.server
index ba571a27b..26d181754 100644
--- a/apps/decabill/frontend-billing-console/Dockerfile.server
+++ b/apps/decabill/frontend-billing-console/Dockerfile.server
@@ -4,9 +4,9 @@
 # Registry:   ghcr.io/forepath/decabill-billing-console-server
 # Base:       node:24.14.1-alpine
 # User:       node (APP_UID / APP_GID, default 1000)
-# Exposes:    4500 (Express static server)
+# Exposes:    4202 (Express static server)
 # Build:      npx nx run frontend-billing-console:server-container-image
-# Run:        nx docker:run decabill-frontend-billing-console -p 4500:4500
+# Run:        nx docker:run decabill-frontend-billing-console -p 4202:4202
 # Notes:      Optional runtime env CONFIG=<url> for GET /config JSON merge
 # -----------------------------------------------------------------------------
 #
@@ -18,7 +18,7 @@ ARG VERSION=0.0.0
 ENV VERSION=${VERSION}
 
 ENV HOST=0.0.0.0
-ENV PORT=4500
+ENV PORT=4202
 
 WORKDIR /app
 
diff --git a/apps/decabill/frontend-billing-console/docker-compose.yaml b/apps/decabill/frontend-billing-console/docker-compose.yaml
index 0f52ad11f..77589c32c 100644
--- a/apps/decabill/frontend-billing-console/docker-compose.yaml
+++ b/apps/decabill/frontend-billing-console/docker-compose.yaml
@@ -5,13 +5,13 @@ services:
     container_name: ${BILLING_CONSOLE_SERVER_CONTAINER_NAME:-billing-console-server}
     environment:
       HOST: ${HOST:-0.0.0.0}
-      PORT: ${PORT:-4500}
+      PORT: ${PORT:-4202}
       NODE_ENV: ${NODE_ENV:-production}
       DEFAULT_LOCALE: ${DEFAULT_LOCALE:-en}
       CSP_ENFORCE: ${CSP_ENFORCE:-true}
       CSP_CONNECT_SRC_EXTRA: ${CSP_CONNECT_SRC_EXTRA:-http://host.docker.internal:3200}
     ports:
-      - '${PORT:-4500}:${PORT:-4500}'
+      - '${PORT:-4202}:${PORT:-4202}'
     networks:
       - billing-console-network
     restart: unless-stopped
diff --git a/apps/decabill/frontend-billing-console/project.json b/apps/decabill/frontend-billing-console/project.json
index 9ead47843..c8abb18d9 100644
--- a/apps/decabill/frontend-billing-console/project.json
+++ b/apps/decabill/frontend-billing-console/project.json
@@ -117,7 +117,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4500
+        "port": 4202
       },
       "configurations": {
         "development": {
@@ -160,7 +160,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "decabill-frontend-billing-console:build",
-        "port": 4500,
+        "port": 4202,
         "staticFilePath": "dist/apps/decabill/frontend-billing-console/browser",
         "spa": true
       }
diff --git a/apps/decabill/frontend-billing-console/src/server.ts b/apps/decabill/frontend-billing-console/src/server.ts
index 9399029fe..477752cc5 100644
--- a/apps/decabill/frontend-billing-console/src/server.ts
+++ b/apps/decabill/frontend-billing-console/src/server.ts
@@ -17,7 +17,7 @@ import {
 import express from 'express';
 
 const app = express();
-const port = parseInt(process.env['PORT'] || '4200', 10);
+const port = parseInt(process.env['PORT'] || '4202', 10);
 
 app.use(createSecurityHeadersMiddleware());
 registerRuntimeConfigEndpoint(app);
diff --git a/apps/decabill/frontend-docs/project.json b/apps/decabill/frontend-docs/project.json
index d6d82abec..dcb4b65bc 100644
--- a/apps/decabill/frontend-docs/project.json
+++ b/apps/decabill/frontend-docs/project.json
@@ -141,7 +141,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4401
+        "port": 4201
       },
       "configurations": {
         "production": {
@@ -184,7 +184,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "decabill-frontend-docs:build",
-        "port": 4401,
+        "port": 4201,
         "staticFilePath": "dist/apps/decabill/frontend-docs/browser",
         "spa": true
       }
@@ -238,7 +238,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/shared/frontend-docs",
-        "command": "DOCS_SERVER_IMAGE=ghcr.io/forepath/decabill-docs-server:latest DOCS_SERVER_CONTAINER_NAME=decabill-docs-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=decabill-frontend-docs"
+        "command": "PORT=4201 DOCS_SERVER_IMAGE=ghcr.io/forepath/decabill-docs-server:latest DOCS_SERVER_CONTAINER_NAME=decabill-docs-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=decabill-frontend-docs"
       }
     },
     "sbom": {
diff --git a/apps/decabill/frontend-landingpage/Dockerfile.server b/apps/decabill/frontend-landingpage/Dockerfile.server
index 3d0b9e396..da8083645 100644
--- a/apps/decabill/frontend-landingpage/Dockerfile.server
+++ b/apps/decabill/frontend-landingpage/Dockerfile.server
@@ -4,9 +4,9 @@
 # Registry:   ghcr.io/forepath/decabill-landingpage-server
 # Base:       node:24.14.1-alpine
 # User:       node (APP_UID / APP_GID, default 1000)
-# Exposes:    4000 (Express static server)
+# Exposes:    4200 (Express static server)
 # Build:      npx nx run decabill-frontend-landingpage:server-container-image
-# Run:        nx docker:run decabill-frontend-landingpage -p 4000:4000
+# Run:        nx docker:run decabill-frontend-landingpage -p 4200:4200
 # Notes:      —
 # -----------------------------------------------------------------------------
 #
@@ -18,7 +18,7 @@ ARG VERSION=0.0.0
 ENV VERSION=${VERSION}
 
 ENV HOST=0.0.0.0
-ENV PORT=4000
+ENV PORT=4200
 
 WORKDIR /app
 
diff --git a/apps/decabill/frontend-landingpage/project.json b/apps/decabill/frontend-landingpage/project.json
index 570e90721..e4bdd02cd 100644
--- a/apps/decabill/frontend-landingpage/project.json
+++ b/apps/decabill/frontend-landingpage/project.json
@@ -104,7 +104,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4302
+        "port": 4200
       },
       "configurations": {
         "production": {
@@ -147,7 +147,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "decabill-frontend-landingpage:build",
-        "port": 4302,
+        "port": 4200,
         "staticFilePath": "dist/apps/decabill/frontend-landingpage/browser",
         "spa": true
       }
diff --git a/apps/decabill/frontend-landingpage/src/server.mjs b/apps/decabill/frontend-landingpage/src/server.mjs
index d01283958..f5b9accf0 100644
--- a/apps/decabill/frontend-landingpage/src/server.mjs
+++ b/apps/decabill/frontend-landingpage/src/server.mjs
@@ -69,7 +69,7 @@ const server = createServer(async (req, res) => {
   }
 });
 
-const port = process.env['PORT'] || 4000;
+const port = process.env['PORT'] || 4200;
 
 server.listen(port, () => {
   console.log(`Delegating server running on http://localhost:${port}`);
diff --git a/apps/decabill/frontend-landingpage/src/server.ts b/apps/decabill/frontend-landingpage/src/server.ts
index 2a9764bc6..dbc3e314f 100644
--- a/apps/decabill/frontend-landingpage/src/server.ts
+++ b/apps/decabill/frontend-landingpage/src/server.ts
@@ -14,7 +14,7 @@ const { app, warmStaticCache } = createSsrExpressApp({
 });
 
 if (isMainModule(import.meta.url)) {
-  const port = parseInt(process.env['PORT'] || '4000', 10);
+  const port = parseInt(process.env['PORT'] || '4200', 10);
 
   warmStaticCache()
     .then(() => {
diff --git a/apps/forepath/backend-communication/.start-containers.env.example b/apps/forepath/backend-communication/.start-containers.env.example
index 9d273ccaa..2dd2b11f5 100644
--- a/apps/forepath/backend-communication/.start-containers.env.example
+++ b/apps/forepath/backend-communication/.start-containers.env.example
@@ -1,11 +1,12 @@
+# Local-only defaults for the container stack. Replace placeholders before exposing it.
 # Server
 HOST=0.0.0.0
 PORT=3300
 NODE_ENV=development
 
 # CORS configuration (comma-separated list of allowed origins)
-# Example: CORS_ORIGIN=http://localhost:4200,https://forepath.io
-CORS_ORIGIN=
+# Example: CORS_ORIGIN=http://localhost:4101,http://localhost:4200,http://localhost:4300,https://forepath.io
+CORS_ORIGIN=http://localhost:4101,http://localhost:4200,http://localhost:4300
 
 # Rate limiting (optional overrides)
 RATE_LIMIT_ENABLED=
@@ -25,6 +26,6 @@ CHATWOOT_INBOX_ID=
 OTEL_ENABLED=false
 OTEL_USERNAME=
 OTEL_PASSWORD=
-# OTEL_METRICS_PATH=/otel/metrics
-# OTEL_SERVICE_NAME=
-# OTEL_EXPORTER_OTLP_ENDPOINT=
+OTEL_METRICS_PATH=/otel/metrics
+OTEL_SERVICE_NAME=
+OTEL_EXPORTER_OTLP_ENDPOINT=
diff --git a/apps/forepath/backend-communication/docker-compose.yaml b/apps/forepath/backend-communication/docker-compose.yaml
index 44735eacf..c78e1f41d 100644
--- a/apps/forepath/backend-communication/docker-compose.yaml
+++ b/apps/forepath/backend-communication/docker-compose.yaml
@@ -2,7 +2,7 @@ x-backend-communication-environment: &backend-communication-environment
   HOST: ${HOST:-0.0.0.0}
   PORT: ${PORT:-3300}
   NODE_ENV: ${NODE_ENV:-development}
-  CORS_ORIGIN: ${CORS_ORIGIN:-}
+  CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:4101,http://localhost:4200,http://localhost:4300}
   RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-}
   RATE_LIMIT_TTL: ${RATE_LIMIT_TTL:-60}
   RATE_LIMIT_LIMIT: ${RATE_LIMIT_LIMIT:-100}
diff --git a/apps/forepath/backend-communication/project.json b/apps/forepath/backend-communication/project.json
index 8d5363600..d6438bd84 100644
--- a/apps/forepath/backend-communication/project.json
+++ b/apps/forepath/backend-communication/project.json
@@ -114,7 +114,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/forepath/backend-communication",
-        "command": "docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=forepath-backend-communication"
+        "command": "docker compose --env-file .start-containers.env up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=forepath-backend-communication"
       }
     },
     "openapi-client-js": {
diff --git a/apps/forepath/frontend-billing-console/project.json b/apps/forepath/frontend-billing-console/project.json
index 36965c95b..fcff2941d 100644
--- a/apps/forepath/frontend-billing-console/project.json
+++ b/apps/forepath/frontend-billing-console/project.json
@@ -121,7 +121,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4500
+        "port": 4301
       },
       "configurations": {
         "development": {
@@ -164,7 +164,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "forepath-frontend-billing-console:build",
-        "port": 4500,
+        "port": 4301,
         "staticFilePath": "dist/apps/forepath/frontend-billing-console/browser",
         "spa": true
       }
@@ -245,7 +245,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/decabill/frontend-billing-console",
-        "command": "BILLING_CONSOLE_SERVER_IMAGE=ghcr.io/forepath/forepath-billing-console-server:latest BILLING_CONSOLE_SERVER_CONTAINER_NAME=forepath-billing-console-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=forepath-frontend-billing-console"
+        "command": "PORT=4301 BILLING_CONSOLE_SERVER_IMAGE=ghcr.io/forepath/forepath-billing-console-server:latest BILLING_CONSOLE_SERVER_CONTAINER_NAME=forepath-billing-console-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=forepath-frontend-billing-console"
       }
     },
     "sbom": {
diff --git a/apps/forepath/frontend-landingpage/Dockerfile b/apps/forepath/frontend-landingpage/Dockerfile
index 0a6948ed9..a68252ffe 100644
--- a/apps/forepath/frontend-landingpage/Dockerfile
+++ b/apps/forepath/frontend-landingpage/Dockerfile
@@ -2,7 +2,7 @@
 # Build the docker image with `npx nx docker:build forepath-frontend-landingpage`.
 # Tip: Modify "docker:build" options in project.json to change docker build args.
 #
-# Run the container with `nx docker:run forepath-frontend-landingpage -p 3000:3000`.
+# Run the container with `nx docker:run forepath-frontend-landingpage -p 4300:4300`.
 #
 FROM docker.io/node:lts-alpine
 
@@ -10,7 +10,7 @@ ARG VERSION=0.0.0
 ENV VERSION=${VERSION}
 
 ENV HOST=0.0.0.0
-ENV PORT=4000
+ENV PORT=4300
 
 
 WORKDIR /app
diff --git a/apps/forepath/frontend-landingpage/Dockerfile.server b/apps/forepath/frontend-landingpage/Dockerfile.server
index cba26c761..50a74ee5d 100644
--- a/apps/forepath/frontend-landingpage/Dockerfile.server
+++ b/apps/forepath/frontend-landingpage/Dockerfile.server
@@ -4,7 +4,7 @@
 # Registry:   ghcr.io/forepath/forepath-landingpage-server
 # Base:       node:24.14.1-alpine
 # User:       node (APP_UID / APP_GID, default 1000)
-# Exposes:    4000 (Express static server)
+# Exposes:    4300 (Express static server)
 # Build:      npx nx run forepath-frontend-landingpage:server-container-image
 # -----------------------------------------------------------------------------
 #
@@ -16,7 +16,7 @@ ARG VERSION=0.0.0
 ENV VERSION=${VERSION}
 
 ENV HOST=0.0.0.0
-ENV PORT=4000
+ENV PORT=4300
 
 WORKDIR /app
 
diff --git a/apps/forepath/frontend-landingpage/docker-compose.yaml b/apps/forepath/frontend-landingpage/docker-compose.yaml
index 663752442..7437629f6 100644
--- a/apps/forepath/frontend-landingpage/docker-compose.yaml
+++ b/apps/forepath/frontend-landingpage/docker-compose.yaml
@@ -6,11 +6,11 @@ services:
     environment:
       # Frontend server configuration
       HOST: ${HOST:-0.0.0.0}
-      PORT: ${PORT:-4200}
+      PORT: ${PORT:-4300}
       NODE_ENV: ${NODE_ENV:-production}
       DEFAULT_LOCALE: ${DEFAULT_LOCALE:-en}
     ports:
-      - '${PORT:-4200}:${PORT:-4200}'
+      - '${PORT:-4300}:${PORT:-4300}'
     networks:
       - landingpage-network
     restart: unless-stopped
diff --git a/apps/forepath/frontend-landingpage/project.json b/apps/forepath/frontend-landingpage/project.json
index d71007ea1..09fd87b2a 100644
--- a/apps/forepath/frontend-landingpage/project.json
+++ b/apps/forepath/frontend-landingpage/project.json
@@ -106,7 +106,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4400
+        "port": 4300
       },
       "configurations": {
         "production": {
@@ -149,7 +149,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "forepath-frontend-landingpage:build",
-        "port": 4400,
+        "port": 4300,
         "staticFilePath": "dist/apps/forepath/frontend-landingpage/browser",
         "spa": true
       }
diff --git a/apps/forepath/frontend-landingpage/src/server.mjs b/apps/forepath/frontend-landingpage/src/server.mjs
index d01283958..25b565199 100644
--- a/apps/forepath/frontend-landingpage/src/server.mjs
+++ b/apps/forepath/frontend-landingpage/src/server.mjs
@@ -69,7 +69,7 @@ const server = createServer(async (req, res) => {
   }
 });
 
-const port = process.env['PORT'] || 4000;
+const port = process.env['PORT'] || 4300;
 
 server.listen(port, () => {
   console.log(`Delegating server running on http://localhost:${port}`);
diff --git a/apps/forepath/frontend-landingpage/src/server.ts b/apps/forepath/frontend-landingpage/src/server.ts
index 93fd346d2..5fedfdc2d 100644
--- a/apps/forepath/frontend-landingpage/src/server.ts
+++ b/apps/forepath/frontend-landingpage/src/server.ts
@@ -20,10 +20,10 @@ const { app, warmStaticCache } = createSsrExpressApp({
 
 /**
  * Start the server if this module is the main entry point.
- * The server listens on the port defined by the `PORT` environment variable, or defaults to 4000.
+ * The server listens on the port defined by the `PORT` environment variable, or defaults to 4300.
  */
 if (isMainModule(import.meta.url)) {
-  const port = parseInt(process.env['PORT'] || '4000', 10);
+  const port = parseInt(process.env['PORT'] || '4300', 10);
 
   warmStaticCache()
     .then(() => {
diff --git a/apps/shared/frontend-docs/Dockerfile.server b/apps/shared/frontend-docs/Dockerfile.server
index 394ca3a20..0da60e809 100644
--- a/apps/shared/frontend-docs/Dockerfile.server
+++ b/apps/shared/frontend-docs/Dockerfile.server
@@ -4,9 +4,9 @@
 # Registry:   ghcr.io/forepath/agenstra-docs-server
 # Base:       node:24.14.1-alpine
 # User:       node (APP_UID / APP_GID, default 1000)
-# Exposes:    4000 (Express static server)
+# Exposes:    4400 (Express static server)
 # Build:      npx nx run frontend-docs:server-container-image
-# Run:        nx docker:run agenstra-frontend-docs -p 4000:4000
+# Run:        nx docker:run agenstra-frontend-docs -p 4400:4400
 # Notes:      —
 # -----------------------------------------------------------------------------
 #
@@ -18,7 +18,7 @@ ARG VERSION=0.0.0
 ENV VERSION=${VERSION}
 
 ENV HOST=0.0.0.0
-ENV PORT=4000
+ENV PORT=4400
 
 WORKDIR /app
 
diff --git a/apps/shared/frontend-docs/docker-compose.yaml b/apps/shared/frontend-docs/docker-compose.yaml
index 41f5cedbe..2a0b33a7f 100644
--- a/apps/shared/frontend-docs/docker-compose.yaml
+++ b/apps/shared/frontend-docs/docker-compose.yaml
@@ -5,12 +5,12 @@ services:
     container_name: ${DOCS_SERVER_CONTAINER_NAME:-docs-server}
     environment:
       HOST: ${HOST:-0.0.0.0}
-      PORT: ${PORT:-4200}
+      PORT: ${PORT:-4400}
       NODE_ENV: ${NODE_ENV:-production}
       DEFAULT_LOCALE: ${DEFAULT_LOCALE:-en}
       CSP_ENFORCE: ${CSP_ENFORCE:-true}
     ports:
-      - '${PORT:-4200}:${PORT:-4200}'
+      - '${PORT:-4400}:${PORT:-4400}'
     networks:
       - docs-network
     restart: unless-stopped
diff --git a/apps/shared/frontend-docs/src/server.agenstra.ts b/apps/shared/frontend-docs/src/server.agenstra.ts
index 710881d08..acd9154e1 100644
--- a/apps/shared/frontend-docs/src/server.agenstra.ts
+++ b/apps/shared/frontend-docs/src/server.agenstra.ts
@@ -10,7 +10,7 @@ const serverDistFolder = dirname(fileURLToPath(import.meta.url));
 const { app, warmStaticCache } = createDocsServer(['agenstra.com'], bootstrap, serverDistFolder);
 
 if (isMainModule(import.meta.url)) {
-  const port = parseInt(process.env['PORT'] || '4000', 10);
+  const port = parseInt(process.env['PORT'] || '4102', 10);
 
   warmStaticCache()
     .then(() => {
diff --git a/apps/shared/frontend-docs/src/server.decabill.ts b/apps/shared/frontend-docs/src/server.decabill.ts
index 8eb8fdbca..8d5d9265a 100644
--- a/apps/shared/frontend-docs/src/server.decabill.ts
+++ b/apps/shared/frontend-docs/src/server.decabill.ts
@@ -10,7 +10,7 @@ const serverDistFolder = dirname(fileURLToPath(import.meta.url));
 const { app, warmStaticCache } = createDocsServer(['decabill.com'], bootstrap, serverDistFolder);
 
 if (isMainModule(import.meta.url)) {
-  const port = parseInt(process.env['PORT'] || '4000', 10);
+  const port = parseInt(process.env['PORT'] || '4201', 10);
 
   warmStaticCache()
     .then(() => {
diff --git a/apps/shared/frontend-docs/src/server.mjs b/apps/shared/frontend-docs/src/server.mjs
index d01283958..311f86bdd 100644
--- a/apps/shared/frontend-docs/src/server.mjs
+++ b/apps/shared/frontend-docs/src/server.mjs
@@ -69,7 +69,7 @@ const server = createServer(async (req, res) => {
   }
 });
 
-const port = process.env['PORT'] || 4000;
+const port = process.env['PORT'] || 4400;
 
 server.listen(port, () => {
   console.log(`Delegating server running on http://localhost:${port}`);
diff --git a/apps/shared/frontend-docs/src/server.ts b/apps/shared/frontend-docs/src/server.ts
index 710881d08..647898a55 100644
--- a/apps/shared/frontend-docs/src/server.ts
+++ b/apps/shared/frontend-docs/src/server.ts
@@ -10,7 +10,7 @@ const serverDistFolder = dirname(fileURLToPath(import.meta.url));
 const { app, warmStaticCache } = createDocsServer(['agenstra.com'], bootstrap, serverDistFolder);
 
 if (isMainModule(import.meta.url)) {
-  const port = parseInt(process.env['PORT'] || '4000', 10);
+  const port = parseInt(process.env['PORT'] || '4400', 10);
 
   warmStaticCache()
     .then(() => {
diff --git a/docs/agenstra/applications/README.md b/docs/agenstra/applications/README.md
index b51928d5b..a7e115ef3 100644
--- a/docs/agenstra/applications/README.md
+++ b/docs/agenstra/applications/README.md
@@ -63,7 +63,7 @@ Web-based IDE and chat interface built with Angular and NgRx.
 
 **Ports**:
 
-- Development: `4200` (default)
+- Development: `4100` (default)
 - Production: Configurable
 
 ## Application Relationships
diff --git a/docs/agenstra/architecture/components.md b/docs/agenstra/architecture/components.md
index b0e29b39f..731276d0b 100644
--- a/docs/agenstra/architecture/components.md
+++ b/docs/agenstra/architecture/components.md
@@ -91,7 +91,7 @@ This document provides a detailed breakdown of all system components, their resp
 
 **Ports**:
 
-- Development: `4200` (default)
+- Development: `4100` (default)
 - Production: Configurable
 
 **Documentation**: [Frontend Agent Console Application](../applications/frontend-agent-console.md)
diff --git a/docs/agenstra/deployment/docker-deployment.md b/docs/agenstra/deployment/docker-deployment.md
index 663d8c789..c656eb8e4 100644
--- a/docs/agenstra/deployment/docker-deployment.md
+++ b/docs/agenstra/deployment/docker-deployment.md
@@ -132,7 +132,7 @@ services:
       # - CONFIG_ALLOWED_HOSTS=config.example.com
       # - CONFIG_FETCH_TIMEOUT_MS=10000
       # - CONFIG_FETCH_MAX_BYTES=262144
-      - PORT=4200
+      - PORT=4100
 ```
 
 The `CONFIG` variable specifies a URL to a JSON configuration file that will be fetched at runtime and merged with build-time defaults. This allows you to configure frontend applications without rebuilding containers.
@@ -200,7 +200,7 @@ docker run -d \
 # Run frontend agent console (optional per-deployment CONFIG with nested console section)
 docker run -d \
   --name frontend-agent-console \
-  -p 4200:4200 \
+  -p 4100:4100 \
   frontend-agent-console:server
 ```
 
diff --git a/docs/agenstra/deployment/operator-runbook.md b/docs/agenstra/deployment/operator-runbook.md
index d3d5154b1..965a1a006 100644
--- a/docs/agenstra/deployment/operator-runbook.md
+++ b/docs/agenstra/deployment/operator-runbook.md
@@ -41,7 +41,7 @@ Map your intended profile to **[System Requirements](./system-requirements.md)**
 ### Frontend and network
 
 - [ ] Console host sized (≥0.5 vCPU, 512 MiB, 1 GiB)
-- [ ] Ingress plan covers console (**4200**), controller (**3100**: `/api/`, `/socket/`, `/socket.io/`), manager (**3000**: same path layout)
+- [ ] Ingress plan covers console (**4100**), controller (**3100**: `/api/`, `/socket/`, `/socket.io/`), manager (**3000**: same path layout)
 - [ ] Bull Board (`/admin/queues` on controller **3100**) restricted to operations networks
 - [ ] Outbound HTTPS available for provider and proxied agent traffic
 
diff --git a/docs/agenstra/deployment/system-requirements.md b/docs/agenstra/deployment/system-requirements.md
index bc248c5c3..ddbe8825f 100644
--- a/docs/agenstra/deployment/system-requirements.md
+++ b/docs/agenstra/deployment/system-requirements.md
@@ -173,9 +173,9 @@ For production manager-only hosts, cloud sizes such as Hetzner **`cx21`** (2 vCP
 
 | Application   | Image                     | vCPU | Memory limit   | Default port |
 | ------------- | ------------------------- | ---- | -------------- | ------------ |
-| Agent console | `agenstra-console-server` | 0.5  | 512 MiB, 1 GiB | **4200**     |
+| Agent console | `agenstra-console-server` | 0.5  | 512 MiB, 1 GiB | **4100**     |
 
-Optional branded billing UI (`agenstra-billing-console-server`, **4500**) uses the same sizing when deployed alongside the console; it is not required for core agent workflows.
+Optional branded billing UI (`agenstra-billing-console-server`, **4103**) uses the same sizing when deployed alongside the console; it is not required for core agent workflows.
 
 Monaco Editor and chat run in the **browser**. Recommend **4 GiB+** client RAM for comfortable IDE use. Initial bundle budget warns at **500 KB** (errors at **5 MB**).
 
@@ -227,7 +227,7 @@ Managers run on separately provisioned hosts per client/workspace.
 | Provider API keys          |     -      | Optional | Agent workload credentials as required by OpenCode / plugins |
 | Outbound HTTPS             |    Yes     |   Yes    | Proxied agent and provider traffic                           |
 
-Ingress: expose console (**4200** or TLS terminator), controller (**3100**) and manager (**3000**) with `/api/`, `/socket/`, and `/socket.io/` proxied to each service `PORT`. Restrict Bull Board (`/admin/queues` on controller **3100**) to operations networks.
+Ingress: expose console (**4100** or TLS terminator), controller (**3100**) and manager (**3000**) with `/api/`, `/socket/`, and `/socket.io/` proxied to each service `PORT`. Restrict Bull Board (`/admin/queues` on controller **3100**) to operations networks.
 
 ## Related documentation
 
diff --git a/docs/agenstra/getting-started.md b/docs/agenstra/getting-started.md
index 0f462452b..d8ac40955 100644
--- a/docs/agenstra/getting-started.md
+++ b/docs/agenstra/getting-started.md
@@ -136,7 +136,7 @@ GIT_TOKEN=your-git-token
 OPENCODE_AGENT_DOCKER_IMAGE=ghcr.io/forepath/agenstra-manager-worker:latest
 
 # CORS
-CORS_ORIGIN=http://localhost:4200
+CORS_ORIGIN=http://localhost:4100
 ```
 
 ### Frontend Agent Console
@@ -160,7 +160,7 @@ A client represents a connection to a remote agent-manager service. You can eith
 
 ### Connect to Existing Agent-Manager
 
-1. Open the frontend console at `http://localhost:4200`
+1. Open the frontend console at `http://localhost:4100`
 2. Log in (if using Keycloak) or use API key authentication
 3. Navigate to the Clients section
 4. Click "Add Client"
diff --git a/docs/decabill/applications/README.md b/docs/decabill/applications/README.md
index 0a3cf43f0..5af61a615 100644
--- a/docs/decabill/applications/README.md
+++ b/docs/decabill/applications/README.md
@@ -36,7 +36,7 @@ Web application for subscription self-service, invoicing, payments, and billing
 - Admin routes for service catalog, manual billing, and customer profiles
 - Identity integration (login, register, user management)
 
-**Default port**: **4500**
+**Default port**: **4202**
 
 **Docker image**: `ghcr.io/forepath/decabill-billing-console-server:latest`
 
diff --git a/docs/decabill/applications/frontend-billing-console.md b/docs/decabill/applications/frontend-billing-console.md
index 0a03564ad..2001b99dd 100644
--- a/docs/decabill/applications/frontend-billing-console.md
+++ b/docs/decabill/applications/frontend-billing-console.md
@@ -100,12 +100,12 @@ Production and Docker deployments run the compiled Express server from `src/serv
 | Variable                | Default                                              | Purpose                                    |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------ |
 | `HOST`                  | `0.0.0.0`                                            | Bind address                               |
-| `PORT`                  | `4200` in generic server; **4500** in Docker compose | Listen port                                |
+| `PORT`                  | `4202` in generic server; **4202** in Docker compose | Listen port                                |
 | `DEFAULT_LOCALE`        | `en`                                                 | Fallback locale                            |
 | `CSP_ENFORCE`           | `true` in compose                                    | Content-Security-Policy enforcement        |
 | `CSP_CONNECT_SRC_EXTRA` | API origin                                           | Allow API and WebSocket in CSP connect-src |
 
-Local `nx serve` uses the Angular dev server on port **4500** without Express unless you build and run `serve-server`.
+Local `nx serve` uses the Angular dev server on port **4202** without Express unless you build and run `serve-server`.
 
 ## Configuration
 
@@ -118,7 +118,7 @@ billing: {
   tenantId: 'decabill',
   urls: {
     restApi: 'http://localhost:3200/api',
-    frontend: 'http://localhost:4500',
+    frontend: 'http://localhost:4202',
     websocket: 'http://localhost:3200/socket/billing', // or { default, projects }
   },
 },
@@ -160,7 +160,7 @@ Effects call the billing manager HTTP client and socket service; see `billing-co
 ## Development Commands
 
 ```bash
-# Dev server (port 4500)
+# Dev server (port 4202)
 nx serve decabill-frontend-billing-console
 
 # Production build (localized)
diff --git a/docs/decabill/architecture/components.md b/docs/decabill/architecture/components.md
index ac594e340..37857dc4e 100644
--- a/docs/decabill/architecture/components.md
+++ b/docs/decabill/architecture/components.md
@@ -81,9 +81,9 @@ This document describes the major runtime components in Decabill, their responsi
 
 | Mode                 | Default  | Notes                               |
 | -------------------- | -------- | ----------------------------------- |
-| `nx serve`           | **4500** | Angular dev server                  |
-| Express SSR / Docker | **4500** | Serves `browser/{locale}` bundles   |
-| `serve-static`       | **4500** | File server for built SPA (non-SSR) |
+| `nx serve`           | **4202** | Angular dev server                  |
+| Express SSR / Docker | **4202** | Serves `browser/{locale}` bundles   |
+| `serve-static`       | **4202** | File server for built SPA (non-SSR) |
 
 **Documentation**: [Frontend Billing Console Application](../applications/frontend-billing-console.md)
 
@@ -107,8 +107,8 @@ This document describes the major runtime components in Decabill, their responsi
 
 | Mode                 | Default  | Notes                             |
 | -------------------- | -------- | --------------------------------- |
-| `nx serve`           | **4302** | Angular dev server                |
-| Express SSR / Docker | **4302** | Serves `browser/{locale}` bundles |
+| `nx serve`           | **4200** | Angular dev server                |
+| Express SSR / Docker | **4200** | Serves `browser/{locale}` bundles |
 
 ## PostgreSQL
 
diff --git a/docs/decabill/deployment/docker-deployment.md b/docs/decabill/deployment/docker-deployment.md
index 0ae0cf970..887d73e5c 100644
--- a/docs/decabill/deployment/docker-deployment.md
+++ b/docs/decabill/deployment/docker-deployment.md
@@ -50,7 +50,7 @@ docker compose up -d
 
 Image: `ghcr.io/forepath/decabill-billing-console-server:latest`
 
-Default port **4500**. Compose sets `CSP_CONNECT_SRC_EXTRA=http://host.docker.internal:3200` so the browser can reach the billing API from the containerized console.
+Default port **4202**. Compose sets `CSP_CONNECT_SRC_EXTRA=http://host.docker.internal:3200` so the browser can reach the billing API from the containerized console.
 
 ### Frontend Docs
 
@@ -61,7 +61,7 @@ docker compose up -d
 
 Image: `ghcr.io/forepath/decabill-docs-server:latest`
 
-Default port **4200**.
+Default port **4201**.
 
 ## Container Configuration
 
@@ -96,7 +96,7 @@ services:
       - CONFIG_ALLOWED_HOSTS=config.example.com
       - CSP_ENFORCE=true
       - CSP_CONNECT_SRC_EXTRA=https://api.billing.example.com
-      - PORT=4500
+      - PORT=4202
 ```
 
 When `CONFIG` is set, the frontend server also supports hardening variables documented in **[Environment Configuration](./environment-configuration.md)** (`CONFIG_ALLOWED_HOSTS`, `CONFIG_FETCH_TIMEOUT_MS`, and related settings).
diff --git a/docs/decabill/deployment/environment-configuration.md b/docs/decabill/deployment/environment-configuration.md
index eb046cef6..77d93a7ae 100644
--- a/docs/decabill/deployment/environment-configuration.md
+++ b/docs/decabill/deployment/environment-configuration.md
@@ -284,7 +284,7 @@ Billing console compose default: `CSP_CONNECT_SRC_EXTRA=http://host.docker.inter
 
 | Variable         | Description                                                            | Default                |
 | ---------------- | ---------------------------------------------------------------------- | ---------------------- |
-| `PORT`           | HTTP port                                                              | `4500` (console image) |
+| `PORT`           | HTTP port                                                              | `4202` (console image) |
 | `HOST`           | Bind address                                                           | `0.0.0.0`              |
 | `DEFAULT_LOCALE` | Default locale                                                         | `en`                   |
 | `API_URL`        | Build-time API URL                                                     | See app config         |
@@ -296,7 +296,7 @@ Runtime `/config` JSON may include `billing.urls.websocket` as a string or `{ de
 
 | Variable         | Description    | Default           |
 | ---------------- | -------------- | ----------------- |
-| `PORT`           | HTTP port      | `4200`            |
+| `PORT`           | HTTP port      | `4201`            |
 | `HOST`           | Bind address   | `0.0.0.0`         |
 | `DEFAULT_LOCALE` | Default locale | `en`              |
 | `CSP_ENFORCE`    | Enforce CSP    | `true` in compose |
diff --git a/docs/decabill/deployment/local-development.md b/docs/decabill/deployment/local-development.md
index dc3df4101..c3e537c5c 100644
--- a/docs/decabill/deployment/local-development.md
+++ b/docs/decabill/deployment/local-development.md
@@ -56,8 +56,8 @@ The billing manager `docker-compose.yaml` starts Postgres, Redis (published on *
 
 ```bash
 cd apps/decabill/backend-billing-manager
-cp .start-containers.env.example .env
-docker compose up -d
+cp .start-containers.env.example .start-containers.env
+docker compose --env-file .start-containers.env up -d
 ```
 
 ## Configuration
@@ -99,7 +99,7 @@ PROJECTS_WEBSOCKET_NAMESPACE=socket/projects
 
 # Multi-tenancy
 TENANTS=default
-BILLING_FRONTEND_URL=http://localhost:4500
+BILLING_FRONTEND_URL=http://localhost:4202
 
 # CORS (for development)
 CORS_ORIGIN=*
@@ -113,8 +113,8 @@ ENCRYPTION_KEY=
 # Stripe (optional for local payment flows)
 STRIPE_SECRET_KEY=
 STRIPE_WEBHOOK_SECRET=
-STRIPE_CHECKOUT_SUCCESS_URL=http://localhost:4500/invoices?payment=success
-STRIPE_CHECKOUT_CANCEL_URL=http://localhost:4500/invoices?payment=cancel
+STRIPE_CHECKOUT_SUCCESS_URL=http://localhost:4202/invoices?payment=success
+STRIPE_CHECKOUT_CANCEL_URL=http://localhost:4202/invoices?payment=cancel
 
 # Provisioning (optional)
 HETZNER_API_TOKEN=
@@ -137,7 +137,7 @@ WEBSOCKET_URL=http://localhost:3200/socket/billing
 Express server variables (when running the SSR server locally):
 
 ```bash
-PORT=4500
+PORT=4202
 CSP_ENFORCE=false
 CSP_CONNECT_SRC_EXTRA=http://localhost:3200
 ```
@@ -145,7 +145,7 @@ CSP_CONNECT_SRC_EXTRA=http://localhost:3200
 ### Frontend Docs
 
 ```bash
-PORT=4200
+PORT=4201
 CSP_ENFORCE=false
 ```
 
@@ -225,7 +225,7 @@ See **[Background Jobs](./background-jobs.md)**.
 
 ### Port Conflicts
 
-- Billing API: **3200** (REST + Socket.IO), console: **4500**, docs: **4200**, Redis host port: **6380**. Change ports in `.env` if needed: `lsof -i :3200`
+- Billing API: **3200** (REST + Socket.IO), console: **4202**, docs: **4201**, Redis host port: **6380**. Change ports in `.env` if needed: `lsof -i :3200`
 
 ## Related documentation
 
diff --git a/docs/decabill/deployment/operator-runbook.md b/docs/decabill/deployment/operator-runbook.md
index bca272031..8df1ebf70 100644
--- a/docs/decabill/deployment/operator-runbook.md
+++ b/docs/decabill/deployment/operator-runbook.md
@@ -38,7 +38,7 @@ Map your intended profile to **[System Requirements](./system-requirements.md)**
 ### Frontend and network
 
 - [ ] Billing console sized (≥0.5 vCPU, 512 MiB, 1 GiB)
-- [ ] Ingress plan covers console (**4500**) and API (**3200**: `/api/`, `/socket/`, `/socket.io/`)
+- [ ] Ingress plan covers console (**4202**) and API (**3200**: `/api/`, `/socket/`, `/socket.io/`)
 - [ ] Bull Board (`/admin/queues`) restricted to operations networks
 - [ ] Production SMTP replaces Mailhog; outbound HTTPS available for Stripe and cloud providers
 
diff --git a/docs/decabill/deployment/system-requirements.md b/docs/decabill/deployment/system-requirements.md
index 6f95dcbe6..9ecf548ca 100644
--- a/docs/decabill/deployment/system-requirements.md
+++ b/docs/decabill/deployment/system-requirements.md
@@ -133,7 +133,7 @@ Angular SSR Express server. No database or Redis on this host.
 
 | Application     | Image                             | vCPU | Memory limit   | Disk  | Default port |
 | --------------- | --------------------------------- | ---- | -------------- | ----- | ------------ |
-| Billing console | `decabill-billing-console-server` | 0.5  | 512 MiB, 1 GiB | 2 GiB | **4500**     |
+| Billing console | `decabill-billing-console-server` | 0.5  | 512 MiB, 1 GiB | 2 GiB | **4202**     |
 
 Browser clients need a modern evergreen browser. The billing console initial bundle budget warns at **1 MB** (errors at **5 MB**).
 
@@ -193,7 +193,7 @@ Acceptable for staging or a single-tenant pilot. Split worker from API before pr
 | Hetzner / DigitalOcean API | Optional   | When service plans include infrastructure           |
 | Outbound HTTPS             | Yes        | Payment, cloud, and email providers                 |
 
-Ingress: expose console (**4500** or behind TLS terminator) and API (**3200**) with `/api/`, `/socket/`, and `/socket.io/` proxied to `PORT`. Restrict Bull Board (`/admin/queues`) to operations networks.
+Ingress: expose console (**4202** or behind TLS terminator) and API (**3200**) with `/api/`, `/socket/`, and `/socket.io/` proxied to `PORT`. Restrict Bull Board (`/admin/queues`) to operations networks.
 
 ## Related documentation
 
diff --git a/docs/decabill/getting-started.md b/docs/decabill/getting-started.md
index 162a054eb..e243d5506 100644
--- a/docs/decabill/getting-started.md
+++ b/docs/decabill/getting-started.md
@@ -28,11 +28,11 @@ The fastest way to run the full backend stack and the SSR billing console is Doc
 git clone https://github.com/forepath/one.git
 cd one/apps/decabill/backend-billing-manager
 
-cp .start-containers.env.example .env
+cp .start-containers.env.example .start-containers.env
 
-# Edit .env: set STATIC_API_KEY, ENCRYPTION_KEY, issuer fields, and TENANTS as needed
+# Local placeholder credentials are included; replace them before exposing the stack.
 
-docker compose up -d
+docker compose --env-file .start-containers.env up -d
 ```
 
 This starts:
@@ -60,7 +60,7 @@ cd one/apps/decabill/frontend-billing-console
 docker compose up -d
 ```
 
-The console server listens on **4500** by default. Set `CSP_CONNECT_SRC_EXTRA` in compose if the API is not reachable from the browser at the default billing manager URL.
+The console server listens on **4202** by default. Set `CSP_CONNECT_SRC_EXTRA` in compose if the API is not reachable from the browser at the default billing manager URL.
 
 See **[Docker Deployment](./deployment/docker-deployment.md)** for production-oriented compose notes.
 
@@ -85,7 +85,7 @@ cp .start-containers.env.example .env
 
 nx serve decabill-backend-billing-manager
 
-# Terminal 2: billing console (Angular dev server on port 4500)
+# Terminal 2: billing console (Angular dev server on port 4202)
 cd apps/decabill/frontend-billing-console
 nx serve decabill-frontend-billing-console
 ```
@@ -152,7 +152,7 @@ PROJECTS_WEBSOCKET_NAMESPACE=socket/projects
 
 # Multi-tenancy and console URL
 TENANTS=decabill
-BILLING_FRONTEND_URL=http://localhost:4500
+BILLING_FRONTEND_URL=http://localhost:4202
 CORS_ORIGIN=*
 
 # Encryption (set before storing sensitive provider or SSH fields)
@@ -161,8 +161,8 @@ ENCRYPTION_KEY=
 # Stripe (optional)
 STRIPE_SECRET_KEY=
 STRIPE_WEBHOOK_SECRET=
-STRIPE_CHECKOUT_SUCCESS_URL=http://localhost:4500/invoices?payment=success
-STRIPE_CHECKOUT_CANCEL_URL=http://localhost:4500/invoices?payment=cancel
+STRIPE_CHECKOUT_SUCCESS_URL=http://localhost:4202/invoices?payment=success
+STRIPE_CHECKOUT_CANCEL_URL=http://localhost:4202/invoices?payment=cancel
 ```
 
 The full variable list is in **[Environment Configuration](./deployment/environment-configuration.md)**.
@@ -173,7 +173,7 @@ Local Angular builds use `environment.billing-console.ts` in `@forepath/decabill
 
 - REST API: `http://localhost:3200/api`
 - WebSocket: `http://localhost:3200/socket/billing`
-- Frontend URL: `http://localhost:4500`
+- Frontend URL: `http://localhost:4202`
 - Default tenant id: `decabill`
 
 Match `authentication.type` in the environment file to the backend `AUTHENTICATION_METHOD`. The Docker SSR image exposes runtime config via the Express `/config` endpoint. See **[Frontend Billing Console](./applications/frontend-billing-console.md)**.
@@ -201,7 +201,7 @@ Optional: set `STATIC_API_KEY_TENANT_ID` to bind the key to one tenant. See **[M
 1. Run or connect to a Keycloak realm and client for Decabill.
 2. Set `AUTHENTICATION_METHOD=keycloak` and the Keycloak environment variables on the billing manager.
 3. Configure the billing console for Keycloak (runtime config or build-time environment).
-4. Open `http://localhost:4500/login` and complete the OAuth2/OIDC flow.
+4. Open `http://localhost:4202/login` and complete the OAuth2/OIDC flow.
 
 The first user synced into a tenant receives the admin role. Subsequent synced users receive the standard user role.
 
@@ -209,9 +209,9 @@ The first user synced into a tenant receives the admin role. Subsequent synced u
 
 When `AUTHENTICATION_METHOD=users` and the console `authentication.type` is `users`:
 
-1. Open `http://localhost:4500/register` and create an account (unless `DISABLE_SIGNUP=true`).
+1. Open `http://localhost:4202/register` and create an account (unless `DISABLE_SIGNUP=true`).
 2. Confirm email when prompted (Mailhog UI is on port **8026** when using the billing manager compose stack).
-3. Log in at `http://localhost:4500/login`.
+3. Log in at `http://localhost:4202/login`.
 
 The first registered user in each tenant is auto-confirmed and assigned admin. Later users may need email confirmation.
 
@@ -239,7 +239,7 @@ Confirm WebSocket dashboard updates on the overview page when logged in as an en
 ## Troubleshooting
 
 - Database or Redis errors: see **[Local Development](./deployment/local-development.md)**.
-- Port conflicts: billing API **3200**, console **4500**, Redis host **6380**.
+- Port conflicts: billing API **3200**, console **4202**, Redis host **6380**.
 - Migrations run only when `QUEUE_ROLE` is `api` or `all`. Ensure at least one API role process has started.
 
 ---
diff --git a/docs/decabill/security/container-images.md b/docs/decabill/security/container-images.md
index 7c49954c6..264d87c46 100644
--- a/docs/decabill/security/container-images.md
+++ b/docs/decabill/security/container-images.md
@@ -59,7 +59,7 @@ Unlike agent orchestration API images, the billing API image does **not** requir
 
 Source: `apps/decabill/frontend-billing-console/Dockerfile.server`
 
-- Default `PORT=4500`
+- Default `PORT=4202`
 - Runs as **`node`** (UID **1000**)
 - Runtime `CONFIG` URL and CSP variables documented in **[Environment configuration](../deployment/environment-configuration.md)** Compose often sets `CSP_CONNECT_SRC_EXTRA` to reach the billing API from the browser
 
@@ -67,7 +67,7 @@ Source: `apps/decabill/frontend-billing-console/Dockerfile.server`
 
 Source: `apps/shared/frontend-docs/Dockerfile.server` (same pattern as billing console)
 
-- Default `PORT=4200`
+- Default `PORT=4201`
 - Runs as **`node`** (UID **1000**)
 - Static documentation content; typically fewer `connect-src` requirements than the billing console
 
diff --git a/docs/port-allocation.md b/docs/port-allocation.md
new file mode 100644
index 000000000..caa368cd3
--- /dev/null
+++ b/docs/port-allocation.md
@@ -0,0 +1,40 @@
+# Application Port Allocation
+
+Application listeners use separate numeric bands: backend HTTP services use `3xxx`, frontend HTTP servers use `4xxx`, and networked MCP transports are reserved for `5xxx`. Port assignments are unique across this workspace so apps can run together without local binding conflicts.
+
+## Application Listeners
+
+| Application                   | Port | Listener                       |
+| ----------------------------- | ---: | ------------------------------ |
+| Agenstra agent manager API    | 3000 | HTTP, Socket.IO, VNC websocket |
+| Agenstra agent controller API | 3100 | HTTP, Socket.IO, VNC websocket |
+| Decabill billing manager API  | 3200 | HTTP, Socket.IO                |
+| Forepath communication API    | 3300 | HTTP                           |
+| Agenstra agent console        | 4100 | Frontend                       |
+| Agenstra landing page         | 4101 | Frontend                       |
+| Agenstra documentation        | 4102 | Frontend                       |
+| Agenstra billing console      | 4103 | Frontend                       |
+| Decabill landing page         | 4200 | Frontend                       |
+| Decabill documentation        | 4201 | Frontend                       |
+| Decabill billing console      | 4202 | Frontend                       |
+| Forepath landing page         | 4300 | Frontend                       |
+| Forepath billing console      | 4301 | Frontend                       |
+| Shared documentation          | 4400 | Frontend                       |
+| Shared UI Storybook           | 4401 | Frontend tooling               |
+
+The `ai`, `code`, `graph`, and shared MCP proxy servers use stdio transport and do not bind network ports. Reserve `5xxx` for MCP servers that introduce a network transport. The native agent console selects an available local port at runtime.
+
+## Supporting Services
+
+These are infrastructure or worker ports, not app HTTP listeners; their assignments remain outside the application bands.
+
+| Service                          | Host/container port                                        |
+| -------------------------------- | ---------------------------------------------------------- |
+| Agent worker OpenCode server     | 4096                                                       |
+| Agent worker VNC                 | 5901 (container-internal)                                  |
+| Agent worker VNC websocket proxy | 6080                                                       |
+| PostgreSQL                       | 5432 (container-internal)                                  |
+| Redis                            | 6379; Decabill Compose publishes host `6380`               |
+| OpenSearch                       | 9200; Decabill Compose publishes host `9201`               |
+| Keycloak                         | host `8380` to container `8080`                            |
+| MailHog                          | controller host `1025`/`8025`; Decabill host `1026`/`8026` |
diff --git a/graph/graph.json b/graph/graph.json
index 9a4bc3bea..13b00ae5f 100644
--- a/graph/graph.json
+++ b/graph/graph.json
@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-10-07T14:23:11.162Z",
+  "generatedAt": "2026-10-07T15:39:25.774Z",
   "nodes": [
     {
       "id": "project:@forepath/test/mounted-plugin-fixture",
@@ -14657,6 +14657,14 @@
         "languageOrKind": "md"
       }
     },
+    {
+      "id": "file:docs/port-allocation.md",
+      "type": "doc",
+      "attrs": {
+        "path": "docs/port-allocation.md",
+        "languageOrKind": "md"
+      }
+    },
     {
       "id": "file:CHANGELOG.md",
       "type": "readme",
@@ -27832,12 +27840,12 @@
       }
     },
     {
-      "id": "concept:decabill-dev-server-port-4500",
+      "id": "concept:decabill-dev-server-port-4202",
       "type": "concept",
       "attrs": {
-        "title": "Dev server (port 4500)",
+        "title": "Dev server (port 4202)",
         "docPath": "docs/decabill/applications/frontend-billing-console.md",
-        "sectionAnchor": "dev-server-port-4500",
+        "sectionAnchor": "dev-server-port-4202",
         "domain": "decabill"
       }
     },
@@ -31862,12 +31870,12 @@
       }
     },
     {
-      "id": "concept:decabill-edit-env-set-static-api-key-encryption-key-issuer-fields-and-tenants-as-needed",
+      "id": "concept:decabill-local-placeholder-credentials-are-included-replace-them-before-exposing-the-stack",
       "type": "concept",
       "attrs": {
-        "title": "Edit .env: set STATIC_API_KEY, ENCRYPTION_KEY, issuer fields, and TENANTS as needed",
+        "title": "Local placeholder credentials are included; replace them before exposing the stack.",
         "docPath": "docs/decabill/getting-started.md",
-        "sectionAnchor": "edit-env-set-static-api-key-encryption-key-issuer-fields-and-tenants-as-needed",
+        "sectionAnchor": "local-placeholder-credentials-are-included-replace-them-before-exposing-the-stack",
         "domain": "decabill"
       }
     },
@@ -31892,12 +31900,12 @@
       }
     },
     {
-      "id": "concept:decabill-terminal-2-billing-console-angular-dev-server-on-port-4500",
+      "id": "concept:decabill-terminal-2-billing-console-angular-dev-server-on-port-4202",
       "type": "concept",
       "attrs": {
-        "title": "Terminal 2: billing console (Angular dev server on port 4500)",
+        "title": "Terminal 2: billing console (Angular dev server on port 4202)",
         "docPath": "docs/decabill/getting-started.md",
-        "sectionAnchor": "terminal-2-billing-console-angular-dev-server-on-port-4500",
+        "sectionAnchor": "terminal-2-billing-console-angular-dev-server-on-port-4202",
         "domain": "decabill"
       }
     },
@@ -32961,6 +32969,36 @@
         "domain": "forepath"
       }
     },
+    {
+      "id": "concept:port-allocation.md-application-port-allocation",
+      "type": "concept",
+      "attrs": {
+        "title": "Application Port Allocation",
+        "docPath": "docs/port-allocation.md",
+        "sectionAnchor": "application-port-allocation",
+        "domain": "port-allocation.md"
+      }
+    },
+    {
+      "id": "concept:port-allocation.md-application-listeners",
+      "type": "concept",
+      "attrs": {
+        "title": "Application Listeners",
+        "docPath": "docs/port-allocation.md",
+        "sectionAnchor": "application-listeners",
+        "domain": "port-allocation.md"
+      }
+    },
+    {
+      "id": "concept:port-allocation.md-supporting-services",
+      "type": "concept",
+      "attrs": {
+        "title": "Supporting Services",
+        "docPath": "docs/port-allocation.md",
+        "sectionAnchor": "supporting-services",
+        "domain": "port-allocation.md"
+      }
+    },
     {
       "id": "domain:shared",
       "type": "domain",
@@ -33100,6 +33138,16 @@
         "label": "bounded context",
         "source": "tag"
       }
+    },
+    {
+      "id": "domain:port-allocation-md",
+      "type": "domain",
+      "attrs": {
+        "name": "port-allocation.md",
+        "kind": "domain",
+        "label": "domain",
+        "source": "docs"
+      }
     }
   ],
   "edges": [
@@ -49375,7 +49423,7 @@
     },
     {
       "from": "file:docs/decabill/applications/frontend-billing-console.md",
-      "to": "concept:decabill-dev-server-port-4500",
+      "to": "concept:decabill-dev-server-port-4202",
       "type": "contains"
     },
     {
@@ -52130,7 +52178,7 @@
     },
     {
       "from": "file:docs/decabill/getting-started.md",
-      "to": "concept:decabill-edit-env-set-static-api-key-encryption-key-issuer-fields-and-tenants-as-needed",
+      "to": "concept:decabill-local-placeholder-credentials-are-included-replace-them-before-exposing-the-stack",
       "type": "contains"
     },
     {
@@ -52145,7 +52193,7 @@
     },
     {
       "from": "file:docs/decabill/getting-started.md",
-      "to": "concept:decabill-terminal-2-billing-console-angular-dev-server-on-port-4500",
+      "to": "concept:decabill-terminal-2-billing-console-angular-dev-server-on-port-4202",
       "type": "contains"
     },
     {
@@ -52788,6 +52836,21 @@
       "to": "concept:forepath-api-reference",
       "type": "contains"
     },
+    {
+      "from": "file:docs/port-allocation.md",
+      "to": "concept:port-allocation.md-application-port-allocation",
+      "type": "contains"
+    },
+    {
+      "from": "file:docs/port-allocation.md",
+      "to": "concept:port-allocation.md-application-listeners",
+      "type": "contains"
+    },
+    {
+      "from": "file:docs/port-allocation.md",
+      "to": "concept:port-allocation.md-supporting-services",
+      "type": "contains"
+    },
     {
       "from": "file:libs/domains/forepath/backend/feature-communication-manager/src/lib/controllers/public-contact-requests.controller.ts",
       "to": "api:HTTP:POST:/public/contact-requests",
@@ -72889,7 +72952,7 @@
       "type": "documents"
     },
     {
-      "from": "concept:decabill-dev-server-port-4500",
+      "from": "concept:decabill-dev-server-port-4202",
       "to": "project:decabill-frontend-billing-console",
       "type": "documents"
     },
@@ -76519,12 +76582,12 @@
       "type": "documents"
     },
     {
-      "from": "concept:decabill-edit-env-set-static-api-key-encryption-key-issuer-fields-and-tenants-as-needed",
+      "from": "concept:decabill-local-placeholder-credentials-are-included-replace-them-before-exposing-the-stack",
       "to": "project:decabill-backend-billing-manager",
       "type": "documents"
     },
     {
-      "from": "concept:decabill-edit-env-set-static-api-key-encryption-key-issuer-fields-and-tenants-as-needed",
+      "from": "concept:decabill-local-placeholder-credentials-are-included-replace-them-before-exposing-the-stack",
       "to": "api:HTTP:GET:/projects",
       "type": "documents"
     },
@@ -76534,7 +76597,7 @@
       "type": "documents"
     },
     {
-      "from": "concept:decabill-terminal-2-billing-console-angular-dev-server-on-port-4500",
+      "from": "concept:decabill-terminal-2-billing-console-angular-dev-server-on-port-4202",
       "to": "project:decabill-frontend-billing-console",
       "type": "documents"
     },
@@ -81014,7 +81077,7 @@
       "type": "belongs_to"
     },
     {
-      "from": "concept:decabill-dev-server-port-4500",
+      "from": "concept:decabill-dev-server-port-4202",
       "to": "domain:decabill",
       "type": "belongs_to"
     },
@@ -83029,7 +83092,7 @@
       "type": "belongs_to"
     },
     {
-      "from": "concept:decabill-edit-env-set-static-api-key-encryption-key-issuer-fields-and-tenants-as-needed",
+      "from": "concept:decabill-local-placeholder-credentials-are-included-replace-them-before-exposing-the-stack",
       "to": "domain:decabill",
       "type": "belongs_to"
     },
@@ -83044,7 +83107,7 @@
       "type": "belongs_to"
     },
     {
-      "from": "concept:decabill-terminal-2-billing-console-angular-dev-server-on-port-4500",
+      "from": "concept:decabill-terminal-2-billing-console-angular-dev-server-on-port-4202",
       "to": "domain:decabill",
       "type": "belongs_to"
     },
@@ -83577,6 +83640,21 @@
       "from": "concept:forepath-api-reference",
       "to": "domain:forepath",
       "type": "belongs_to"
+    },
+    {
+      "from": "concept:port-allocation.md-application-port-allocation",
+      "to": "domain:port-allocation-md",
+      "type": "belongs_to"
+    },
+    {
+      "from": "concept:port-allocation.md-application-listeners",
+      "to": "domain:port-allocation-md",
+      "type": "belongs_to"
+    },
+    {
+      "from": "concept:port-allocation.md-supporting-services",
+      "to": "domain:port-allocation-md",
+      "type": "belongs_to"
     }
   ]
 }
diff --git a/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.agent-console.ts b/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.agent-console.ts
index a06758f50..02a820aa4 100644
--- a/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.agent-console.ts
+++ b/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.agent-console.ts
@@ -4,7 +4,7 @@ import type { AgenstraAgentConsoleEnvironment } from './environment.interface';
 export const environment: AgenstraAgentConsoleEnvironment = {
   ...createAgenstraShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4300/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4100/assets/images/og-preview.png',
   }),
   console: {
     urls: {
diff --git a/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.billing-console.ts b/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.billing-console.ts
index 92ed0da25..6fafc149a 100644
--- a/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.billing-console.ts
+++ b/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.billing-console.ts
@@ -4,12 +4,12 @@ import type { AgenstraBillingConsoleEnvironment } from './environment.interface'
 export const environment: AgenstraBillingConsoleEnvironment = {
   ...createAgenstraShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4300/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4103/assets/images/og-preview.png',
   }),
   billing: {
     urls: {
       restApi: 'http://localhost:3200/api',
-      frontend: 'http://localhost:4500',
+      frontend: 'http://localhost:4103',
       websocket: 'http://localhost:3200/socket/billing',
     },
   },
diff --git a/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.docs.ts b/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.docs.ts
index f8a6f90c9..6dea4287f 100644
--- a/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.docs.ts
+++ b/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.docs.ts
@@ -4,7 +4,7 @@ import type { AgenstraDocsEnvironment } from './environment.interface';
 export const environment: AgenstraDocsEnvironment = {
   ...createAgenstraShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4300/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4102/assets/images/og-preview.png',
   }),
   docs: {
     contentRoot: 'agenstra',
diff --git a/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.landingpage.ts b/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.landingpage.ts
index 91ebce661..681b08b46 100644
--- a/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.landingpage.ts
+++ b/libs/domains/agenstra/frontend/util-configuration/src/lib/environment.landingpage.ts
@@ -6,12 +6,12 @@ import type { AgenstraLandingEnvironment } from './environment.interface';
 export const environment: AgenstraLandingEnvironment = {
   ...createAgenstraShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4300/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4101/assets/images/og-preview.png',
   }),
   landing: {
     urls: {
       restApi: 'http://localhost:3200/api',
-      portal: 'http://localhost:4500',
+      portal: 'http://localhost:4103',
     },
   },
   communication: {
diff --git a/libs/domains/decabill/backend/feature-billing-manager/README.md b/libs/domains/decabill/backend/feature-billing-manager/README.md
index 6aeb6e061..a124cfe3b 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/README.md
+++ b/libs/domains/decabill/backend/feature-billing-manager/README.md
@@ -55,7 +55,7 @@ When **`AUTHENTICATION_METHOD=api-key`** (or api-key is inferred from **`STATIC_
 - `TENANTS_ALLOW_GLOBAL_VIEWS` (optional; default `default`) – tenant ids allowed to use cross-tenant admin views (DATEV unified + File Explorer tenant tabs / consolidation).
 - `STATIC_API_KEY_TENANT_ID` (optional) – when set, API key auth is only accepted for this tenant id (must match `X-Tenant`). When unset, one **`STATIC_API_KEY`** may access **all** configured tenants via **`X-Tenant`** (accepted risk **AR-007**).
 - Public catalog (`/public/service-plan-offerings`) is unauthenticated; tenant is selected via `X-Tenant` (defaults to `default`). Restrict allowed tenants with `TENANTS`.
-- `BILLING_FRONTEND_URL` (optional; default derived from `STRIPE_CHECKOUT_SUCCESS_URL` origin or `http://localhost:4500`) – billing console base URL for the `default` tenant; used for Stripe success/cancel redirects.
+- `BILLING_FRONTEND_URL` (optional; default derived from `STRIPE_CHECKOUT_SUCCESS_URL` origin or `http://localhost:4202`) – billing console base URL for the `default` tenant; used for Stripe success/cancel redirects.
 - `TENANT_FRONTEND_URLS` (optional; `tenantId=https://billing.example.com` pairs, comma-separated) – per-tenant billing console base URLs for Stripe return redirects.
 - BILLING*ISSUER*\* (name, VAT ID, address, email, IBAN) and BILLING_TAX_RATE_STANDARD / BILLING_TAX_RATE_REDUCED
 - BILLING_STATUTORY_WITHDRAWAL_PERIOD_DAYS (default 14) — statutory withdrawal window after provisioning
diff --git a/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/agenstra-controller/agent-controller.utils.spec.ts b/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/agenstra-controller/agent-controller.utils.spec.ts
index 2165b316e..c6d848c7d 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/agenstra-controller/agent-controller.utils.spec.ts
+++ b/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/agenstra-controller/agent-controller.utils.spec.ts
@@ -34,6 +34,7 @@ describe('cloud-init.utils', () => {
       expect(config.host.hostname).toBe('awesome-armadillo-abc12');
       expect(config.host.fqdn).toBe('awesome-armadillo-abc12.spirde.com');
       expect(config.backend.cors.origin).toBe('https://awesome-armadillo-abc12.spirde.com');
+      expect(config.frontend.port).toBe(4100);
     });
 
     it('defaults baseDomain to spirde.com when not provided', () => {
@@ -162,7 +163,7 @@ describe('cloud-init.utils', () => {
         ssh: { publicKey: '' },
         host: { hostname: 'test', fqdn: 'test.spirde.com' },
         proxy: { httpPort: 80, httpsPort: 443 },
-        frontend: { host: '0.0.0.0', port: 4200, nodeEnv: 'production', defaultLocale: 'en' },
+        frontend: { host: '0.0.0.0', port: 4100, nodeEnv: 'production', defaultLocale: 'en' },
         backend: {
           host: '0.0.0.0',
           port: 3100,
@@ -221,7 +222,7 @@ describe('cloud-init.utils', () => {
         ssh: { publicKey: '' },
         host: { hostname: 'test', fqdn: 'test.spirde.com' },
         proxy: { httpPort: 80, httpsPort: 443 },
-        frontend: { host: '0.0.0.0', port: 4200, nodeEnv: 'production', defaultLocale: 'en' },
+        frontend: { host: '0.0.0.0', port: 4100, nodeEnv: 'production', defaultLocale: 'en' },
         backend: {
           host: '0.0.0.0',
           port: 3100,
@@ -267,7 +268,7 @@ describe('cloud-init.utils', () => {
         ssh: { publicKey: '' },
         host: { hostname: 'test', fqdn: 'test.spirde.com' },
         proxy: { httpPort: 80, httpsPort: 443 },
-        frontend: { host: '0.0.0.0', port: 4200, nodeEnv: 'production', defaultLocale: 'en' },
+        frontend: { host: '0.0.0.0', port: 4100, nodeEnv: 'production', defaultLocale: 'en' },
         backend: {
           host: '0.0.0.0',
           port: 3100,
@@ -326,7 +327,7 @@ describe('cloud-init.utils', () => {
         ssh: { publicKey: '' },
         host: { hostname: 'test', fqdn: 'test.spirde.com' },
         proxy: { httpPort: 80, httpsPort: 443 },
-        frontend: { host: '0.0.0.0', port: 4200, nodeEnv: 'production', defaultLocale: 'en' },
+        frontend: { host: '0.0.0.0', port: 4100, nodeEnv: 'production', defaultLocale: 'en' },
         backend: {
           host: '0.0.0.0',
           port: 3100,
@@ -371,7 +372,7 @@ describe('cloud-init.utils', () => {
         ssh: { publicKey: '' },
         host: { hostname: 'test', fqdn: 'test.spirde.com' },
         proxy: { httpPort: 80, httpsPort: 443 },
-        frontend: { host: '0.0.0.0', port: 4200, nodeEnv: 'production', defaultLocale: 'en' },
+        frontend: { host: '0.0.0.0', port: 4100, nodeEnv: 'production', defaultLocale: 'en' },
         backend: {
           host: '0.0.0.0',
           port: 3100,
@@ -418,7 +419,7 @@ describe('cloud-init.utils', () => {
         ssh: { publicKey: '' },
         host: { hostname: 'my-instance', fqdn: 'my-instance.example.com' },
         proxy: { httpPort: 80, httpsPort: 443 },
-        frontend: { host: '0.0.0.0', port: 4200, nodeEnv: 'production', defaultLocale: 'en' },
+        frontend: { host: '0.0.0.0', port: 4100, nodeEnv: 'production', defaultLocale: 'en' },
         backend: {
           host: '0.0.0.0',
           port: 3100,
@@ -462,7 +463,7 @@ describe('cloud-init.utils', () => {
         ssh: { publicKey: key },
         host: { hostname: 'test', fqdn: 'test.spirde.com' },
         proxy: { httpPort: 80, httpsPort: 443 },
-        frontend: { host: '0.0.0.0', port: 4200, nodeEnv: 'production', defaultLocale: 'en' },
+        frontend: { host: '0.0.0.0', port: 4100, nodeEnv: 'production', defaultLocale: 'en' },
         backend: {
           host: '0.0.0.0',
           port: 3100,
@@ -495,7 +496,7 @@ describe('cloud-init.utils', () => {
         ssh: { publicKey: '' },
         host: { hostname: 'test', fqdn: 'test.spirde.com' },
         proxy: { httpPort: 80, httpsPort: 443 },
-        frontend: { host: '0.0.0.0', port: 4200, nodeEnv: 'production', defaultLocale: 'en' },
+        frontend: { host: '0.0.0.0', port: 4100, nodeEnv: 'production', defaultLocale: 'en' },
         backend: {
           host: '0.0.0.0',
           port: 3100,
diff --git a/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/agenstra-controller/agent-controller.utils.ts b/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/agenstra-controller/agent-controller.utils.ts
index e77324d8e..6cabb4ccc 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/agenstra-controller/agent-controller.utils.ts
+++ b/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/agenstra-controller/agent-controller.utils.ts
@@ -202,7 +202,7 @@ export function buildAgentControllerCloudInitConfigFromRequest(
     },
     frontend: {
       host: '0.0.0.0',
-      port: 4200,
+      port: 4100,
       nodeEnv: 'production',
       defaultLocale: 'en',
     },
@@ -332,7 +332,7 @@ export function buildAgentControllerCloudInitUserData(config: AgentControllerClo
   const frontendEnv = formatEnv([
     // Frontend web server configuration
     `HOST: ${config.frontend?.host ?? '0.0.0.0'}`,
-    `PORT: ${config.frontend?.port ?? '4200'}`,
+    `PORT: ${config.frontend?.port ?? '4100'}`,
     `NODE_ENV: ${config.frontend?.nodeEnv ?? 'production'}`,
     `DEFAULT_LOCALE: ${config.frontend?.defaultLocale ?? 'en'}`,
     // Runtime config proxy hardening: CONFIG_ALLOWED_HOSTS is required in production when CONFIG is set.
@@ -444,7 +444,7 @@ ${OPENSEARCH_COMPOSE_DEPENDS_ON}
     environment:
 ${frontendEnv}
     ports:
-      - '${config.frontend?.port ?? '4200'}:${config.frontend?.port ?? '4200'}'
+      - '${config.frontend?.port ?? '4100'}:${config.frontend?.port ?? '4100'}'
     networks:
       - agent-controller-network
     restart: unless-stopped
@@ -487,7 +487,7 @@ server {
     ssl_ciphers HIGH:!aNULL:!MD5;
 
     location / {
-        proxy_pass http://agent-console-server:${config.frontend?.port ?? '4200'};
+        proxy_pass http://agent-console-server:${config.frontend?.port ?? '4100'};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -558,7 +558,7 @@ server {
     ssl_ciphers HIGH:!aNULL:!MD5;
 
     location / {
-        proxy_pass http://agent-console-server:${config.frontend?.port ?? '4200'};
+        proxy_pass http://agent-console-server:${config.frontend?.port ?? '4100'};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
diff --git a/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/decabill-billing/decabill-billing.utils.spec.ts b/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/decabill-billing/decabill-billing.utils.spec.ts
index 730953c22..749edfd9e 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/decabill-billing/decabill-billing.utils.spec.ts
+++ b/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/decabill-billing/decabill-billing.utils.spec.ts
@@ -19,7 +19,7 @@ describe('decabill-billing.utils', () => {
       expect(config.backend.cors.origin).toBe('https://awesome-armadillo-abc12.spirde.com');
       expect(config.backend.billingFrontendUrl).toBe('https://awesome-armadillo-abc12.spirde.com');
       expect(config.backend.port).toBe(3200);
-      expect(config.frontend.port).toBe(4500);
+      expect(config.frontend.port).toBe(4202);
       expect(config.backend.websocketNamespace).toBe('socket/billing');
     });
 
@@ -75,6 +75,9 @@ describe('decabill-billing.utils', () => {
       expect(script).toContain('nginx:alpine');
       expect(script).toContain('opensearchproject/opensearch:2.19.1');
       expect(script).toContain('container_name: decabill-billing-opensearch');
+      expect(script).toContain('PORT: 4202');
+      expect(script).toContain('4202:4202');
+      expect(script).toContain('proxy_pass http://decabill-billing-console-server:4202;');
       expect(script).toContain('OPENSEARCH_HOST: opensearch');
       expect(script).toContain("OPENSEARCH_NODE: 'http://opensearch:9200'");
       expect(script).toContain('OPENSEARCH_INDEX_PREFIX: decabill');
diff --git a/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/decabill-billing/decabill-billing.utils.ts b/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/decabill-billing/decabill-billing.utils.ts
index 6bd896de8..00e930584 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/decabill-billing/decabill-billing.utils.ts
+++ b/libs/domains/decabill/backend/feature-billing-manager/src/lib/contributors/decabill-billing/decabill-billing.utils.ts
@@ -127,7 +127,7 @@ export function buildDecabillBillingCloudInitConfigFromRequest(
     },
     frontend: {
       host: '0.0.0.0',
-      port: 4500,
+      port: 4202,
       nodeEnv: 'production',
       defaultLocale: 'en',
     },
@@ -234,7 +234,7 @@ export function buildDecabillBillingCloudInitUserData(config: DecabillBillingClo
   const backendSchedulerEnv = formatEnv([...backendEnvBaseLines, `QUEUE_ROLE: scheduler`]);
   const frontendEnv = formatEnv([
     `HOST: ${config.frontend?.host ?? '0.0.0.0'}`,
-    `PORT: ${config.frontend?.port ?? '4500'}`,
+    `PORT: ${config.frontend?.port ?? '4202'}`,
     `NODE_ENV: ${config.frontend?.nodeEnv ?? 'production'}`,
     `DEFAULT_LOCALE: ${config.frontend?.defaultLocale ?? 'en'}`,
     `CONFIG_ALLOWED_HOSTS: ${config.host?.fqdn ?? config.host?.hostname ?? 'localhost'}`,
@@ -347,7 +347,7 @@ ${OPENSEARCH_COMPOSE_DEPENDS_ON}
     environment:
 ${frontendEnv}
     ports:
-      - '${config.frontend?.port ?? '4500'}:${config.frontend?.port ?? '4500'}'
+      - '${config.frontend?.port ?? '4202'}:${config.frontend?.port ?? '4202'}'
     networks:
       - decabill-billing-network
     restart: unless-stopped
@@ -390,7 +390,7 @@ server {
     ssl_ciphers HIGH:!aNULL:!MD5;
 
     location / {
-        proxy_pass http://decabill-billing-console-server:${config.frontend?.port ?? '4500'};
+        proxy_pass http://decabill-billing-console-server:${config.frontend?.port ?? '4202'};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -461,7 +461,7 @@ server {
     ssl_ciphers HIGH:!aNULL:!MD5;
 
     location / {
-        proxy_pass http://decabill-billing-console-server:${config.frontend?.port ?? '4500'};
+        proxy_pass http://decabill-billing-console-server:${config.frontend?.port ?? '4202'};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
diff --git a/libs/domains/decabill/backend/feature-billing-manager/src/lib/services/billing-tenant.service.spec.ts b/libs/domains/decabill/backend/feature-billing-manager/src/lib/services/billing-tenant.service.spec.ts
index 9b201b7d4..0e23315b7 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/src/lib/services/billing-tenant.service.spec.ts
+++ b/libs/domains/decabill/backend/feature-billing-manager/src/lib/services/billing-tenant.service.spec.ts
@@ -63,11 +63,11 @@ describe('BillingTenantService', () => {
   });
 
   it('resolves frontend url per tenant', () => {
-    process.env['BILLING_FRONTEND_URL'] = 'http://localhost:4500';
+    process.env['BILLING_FRONTEND_URL'] = 'http://localhost:4202';
     process.env['TENANT_FRONTEND_URLS'] = 'alpha=https://billing.alpha.example';
     const service = new BillingTenantService();
 
-    expect(service.getFrontendUrlForTenant('default')).toBe('http://localhost:4500');
+    expect(service.getFrontendUrlForTenant('default')).toBe('http://localhost:4202');
     expect(service.getFrontendUrlForTenant('alpha')).toBe('https://billing.alpha.example');
   });
 });
diff --git a/libs/domains/decabill/backend/feature-billing-manager/src/lib/services/payment-orchestration.service.spec.ts b/libs/domains/decabill/backend/feature-billing-manager/src/lib/services/payment-orchestration.service.spec.ts
index b92c55428..fc13cdfcf 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/src/lib/services/payment-orchestration.service.spec.ts
+++ b/libs/domains/decabill/backend/feature-billing-manager/src/lib/services/payment-orchestration.service.spec.ts
@@ -188,7 +188,7 @@ describe('PaymentOrchestrationService', () => {
     });
 
     it('uses tenant-specific stripe return urls', async () => {
-      process.env['BILLING_FRONTEND_URL'] = 'http://localhost:4500';
+      process.env['BILLING_FRONTEND_URL'] = 'http://localhost:4202';
       process.env['TENANT_FRONTEND_URLS'] = 'acme=https://billing.acme.com';
 
       invoicesRepository.findByIdAndSubscriptionId.mockResolvedValue({
diff --git a/libs/domains/decabill/backend/feature-billing-manager/src/lib/utils/tenant-frontend-url.utils.spec.ts b/libs/domains/decabill/backend/feature-billing-manager/src/lib/utils/tenant-frontend-url.utils.spec.ts
index 31a70f25e..33ae408bd 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/src/lib/utils/tenant-frontend-url.utils.spec.ts
+++ b/libs/domains/decabill/backend/feature-billing-manager/src/lib/utils/tenant-frontend-url.utils.spec.ts
@@ -7,7 +7,7 @@ import {
 
 describe('tenant-frontend-url.utils', () => {
   const env = {
-    billingFrontendUrl: 'http://localhost:4500',
+    billingFrontendUrl: 'http://localhost:4202',
     tenantFrontendUrls: 'acme=https://billing.acme.com,corp=https://billing.corp.example',
     stripeCheckoutSuccessUrl: 'http://legacy.example/invoices?payment=success',
     stripeCheckoutCancelUrl: 'http://legacy.example/invoices?payment=cancel',
@@ -26,7 +26,7 @@ describe('tenant-frontend-url.utils', () => {
 
   it('resolveTenantFrontendBaseUrl uses per-tenant override', () => {
     expect(resolveTenantFrontendBaseUrl('acme', env)).toBe('https://billing.acme.com');
-    expect(resolveTenantFrontendBaseUrl('default', env)).toBe('http://localhost:4500');
+    expect(resolveTenantFrontendBaseUrl('default', env)).toBe('http://localhost:4202');
   });
 
   it('resolveTenantFrontendBaseUrl falls back to legacy success url origin', () => {
@@ -64,7 +64,7 @@ describe('tenant-frontend-url.utils', () => {
       resolveTenantFrontendBaseUrl('default', {
         stripeCheckoutSuccessUrl: 'not-a-valid-url',
       }),
-    ).toBe('http://localhost:4500');
+    ).toBe('http://localhost:4202');
   });
 
   it('buildStripeCheckoutReturnUrl uses fallback paths for invalid configured urls', () => {
@@ -82,6 +82,6 @@ describe('tenant-frontend-url.utils', () => {
   });
 
   it('resolveDefaultTenantFrontendBaseUrl resolves default tenant base url', () => {
-    expect(resolveDefaultTenantFrontendBaseUrl(env)).toBe('http://localhost:4500');
+    expect(resolveDefaultTenantFrontendBaseUrl(env)).toBe('http://localhost:4202');
   });
 });
diff --git a/libs/domains/decabill/backend/feature-billing-manager/src/lib/utils/tenant-frontend-url.utils.ts b/libs/domains/decabill/backend/feature-billing-manager/src/lib/utils/tenant-frontend-url.utils.ts
index b9b4d2d7e..dafd0f14a 100644
--- a/libs/domains/decabill/backend/feature-billing-manager/src/lib/utils/tenant-frontend-url.utils.ts
+++ b/libs/domains/decabill/backend/feature-billing-manager/src/lib/utils/tenant-frontend-url.utils.ts
@@ -1,6 +1,6 @@
 import { DEFAULT_TENANT } from '@forepath/shared/backend';
 
-const DEFAULT_FRONTEND_BASE_URL = 'http://localhost:4500';
+const DEFAULT_FRONTEND_BASE_URL = 'http://localhost:4202';
 const DEFAULT_SUCCESS_RETURN_PATH = '/invoices?payment=success';
 const DEFAULT_CANCEL_RETURN_PATH = '/invoices?payment=cancel';
 
diff --git a/libs/domains/decabill/frontend/data-access-billing-console/src/lib/interceptors/tenant.interceptor.spec.ts b/libs/domains/decabill/frontend/data-access-billing-console/src/lib/interceptors/tenant.interceptor.spec.ts
index 5c8f2a70d..edac949f1 100644
--- a/libs/domains/decabill/frontend/data-access-billing-console/src/lib/interceptors/tenant.interceptor.spec.ts
+++ b/libs/domains/decabill/frontend/data-access-billing-console/src/lib/interceptors/tenant.interceptor.spec.ts
@@ -44,7 +44,7 @@ describe('billingTenantInterceptor', () => {
         billing: {
           urls: {
             restApi: 'http://localhost:3200/api',
-            frontend: 'http://localhost:4500',
+            frontend: 'http://localhost:4202',
           },
         },
       } as never),
@@ -57,7 +57,7 @@ describe('billingTenantInterceptor', () => {
         billing: {
           urls: {
             restApi: 'http://localhost:3200/api',
-            frontend: 'http://localhost:4500',
+            frontend: 'http://localhost:4202',
           },
           tenantId: 'one',
         },
@@ -71,7 +71,7 @@ describe('billingTenantInterceptor', () => {
         billing: {
           urls: {
             restApi: 'http://localhost:3200/api',
-            frontend: 'http://localhost:4500',
+            frontend: 'http://localhost:4202',
           },
           tenantId: 'decabill',
         },
@@ -82,7 +82,7 @@ describe('billingTenantInterceptor', () => {
         billing: {
           urls: {
             restApi: 'http://localhost:3200/api',
-            frontend: 'http://localhost:4500',
+            frontend: 'http://localhost:4202',
           },
         },
       } as never),
@@ -93,7 +93,7 @@ describe('billingTenantInterceptor', () => {
     const injector = setupTestBed({
       urls: {
         restApi: 'http://localhost:3200/api',
-        frontend: 'http://localhost:4500',
+        frontend: 'http://localhost:4202',
       },
     });
     const req = new HttpRequest('GET', 'http://other.example/api/data');
@@ -109,7 +109,7 @@ describe('billingTenantInterceptor', () => {
     const injector = setupTestBed({
       urls: {
         restApi: 'http://localhost:3200/api',
-        frontend: 'http://localhost:4500',
+        frontend: 'http://localhost:4202',
       },
     });
     const req = new HttpRequest('GET', 'http://localhost:3200/api/subscriptions');
@@ -133,7 +133,7 @@ describe('billingTenantInterceptor', () => {
             billing: {
               urls: {
                 restApi: 'http://localhost:3200/api',
-                frontend: 'http://localhost:4500',
+                frontend: 'http://localhost:4202',
               },
             },
           },
@@ -156,7 +156,7 @@ describe('billingTenantInterceptor', () => {
     const injector = setupTestBed({
       urls: {
         restApi: 'http://localhost:3200/api',
-        frontend: 'http://localhost:4500',
+        frontend: 'http://localhost:4202',
       },
       tenantId: 'acme',
     });
@@ -182,7 +182,7 @@ describe('billingTenantInterceptor', () => {
               tenantId: 'agenstra',
               urls: {
                 restApi: 'http://localhost:3200/api',
-                portal: 'http://localhost:4500',
+                portal: 'http://localhost:4202',
               },
             },
           },
diff --git a/libs/domains/decabill/frontend/util-configuration/src/lib/environment.billing-console.ts b/libs/domains/decabill/frontend/util-configuration/src/lib/environment.billing-console.ts
index fa6efbbe7..36fd87b2b 100644
--- a/libs/domains/decabill/frontend/util-configuration/src/lib/environment.billing-console.ts
+++ b/libs/domains/decabill/frontend/util-configuration/src/lib/environment.billing-console.ts
@@ -4,14 +4,14 @@ import type { DecabillBillingConsoleEnvironment } from './environment.interface'
 export const environment: DecabillBillingConsoleEnvironment = {
   ...createDecabillShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4302/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4202/assets/images/og-preview.png',
     cookieConsentEnabled: false,
   }),
   billing: {
     tenantId: 'decabill',
     urls: {
       restApi: 'http://localhost:3200/api',
-      frontend: 'http://localhost:4500',
+      frontend: 'http://localhost:4202',
       websocket: 'http://localhost:3200/socket/billing',
     },
   },
diff --git a/libs/domains/decabill/frontend/util-configuration/src/lib/environment.docs.ts b/libs/domains/decabill/frontend/util-configuration/src/lib/environment.docs.ts
index 6964d5d7f..3154f8f06 100644
--- a/libs/domains/decabill/frontend/util-configuration/src/lib/environment.docs.ts
+++ b/libs/domains/decabill/frontend/util-configuration/src/lib/environment.docs.ts
@@ -4,7 +4,7 @@ import type { DecabillDocsEnvironment } from './environment.interface';
 export const environment: DecabillDocsEnvironment = {
   ...createDecabillShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4302/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4201/assets/images/og-preview.png',
     cookieConsentEnabled: true,
   }),
   docs: {
diff --git a/libs/domains/decabill/frontend/util-configuration/src/lib/environment.landingpage.ts b/libs/domains/decabill/frontend/util-configuration/src/lib/environment.landingpage.ts
index 176f56a8a..6062257a9 100644
--- a/libs/domains/decabill/frontend/util-configuration/src/lib/environment.landingpage.ts
+++ b/libs/domains/decabill/frontend/util-configuration/src/lib/environment.landingpage.ts
@@ -6,14 +6,14 @@ import type { DecabillLandingEnvironment } from './environment.interface';
 export const environment: DecabillLandingEnvironment = {
   ...createDecabillShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4302/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4200/assets/images/og-preview.png',
     cookieConsentEnabled: true,
   }),
   landing: {
     tenantId: 'decabill',
     urls: {
       restApi: 'http://localhost:3200/api',
-      portal: 'http://localhost:4500',
+      portal: 'http://localhost:4202',
     },
   },
   communication: {
diff --git a/libs/domains/forepath/frontend/util-configuration/src/lib/environment.billing-console.ts b/libs/domains/forepath/frontend/util-configuration/src/lib/environment.billing-console.ts
index fa4206cbf..87a1cfc3a 100644
--- a/libs/domains/forepath/frontend/util-configuration/src/lib/environment.billing-console.ts
+++ b/libs/domains/forepath/frontend/util-configuration/src/lib/environment.billing-console.ts
@@ -4,13 +4,13 @@ import type { ForepathBillingConsoleEnvironment } from './environment.interface'
 export const environment: ForepathBillingConsoleEnvironment = {
   ...createForepathShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4400/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4301/assets/images/og-preview.png',
   }),
   billing: {
     tenantId: 'forepath',
     urls: {
       restApi: 'http://localhost:3200/api',
-      frontend: 'http://localhost:4500',
+      frontend: 'http://localhost:4301',
       websocket: 'http://localhost:3200/socket/billing',
     },
   },
diff --git a/libs/domains/forepath/frontend/util-configuration/src/lib/environment.landingpage.ts b/libs/domains/forepath/frontend/util-configuration/src/lib/environment.landingpage.ts
index 9a0d73b29..820ff3d9d 100644
--- a/libs/domains/forepath/frontend/util-configuration/src/lib/environment.landingpage.ts
+++ b/libs/domains/forepath/frontend/util-configuration/src/lib/environment.landingpage.ts
@@ -6,12 +6,12 @@ import type { ForepathLandingEnvironment } from './environment.interface';
 export const environment: ForepathLandingEnvironment = {
   ...createForepathShell({
     production: false,
-    socialPreviewImageUrl: 'http://localhost:4400/assets/images/og-preview.png',
+    socialPreviewImageUrl: 'http://localhost:4300/assets/images/og-preview.png',
   }),
   landing: {
     tenantId: 'forepath',
     urls: {
-      portal: 'http://localhost:4500',
+      portal: 'http://localhost:4301',
       restApi: 'http://localhost:3200/api',
     },
   },
diff --git a/libs/domains/shared/frontend/ui-components/README.md b/libs/domains/shared/frontend/ui-components/README.md
index 8c3394a0b..d3cc0a194 100644
--- a/libs/domains/shared/frontend/ui-components/README.md
+++ b/libs/domains/shared/frontend/ui-components/README.md
@@ -103,7 +103,7 @@ tabs include when/where guidance (`parameters.docs.description`). Foundation pag
 **Theming** and **Fonts** (under Foundation in the sidebar).
 
 ```sh
-nx run shared-frontend-ui-components:storybook        # dev server on http://localhost:4400
+nx run shared-frontend-ui-components:storybook        # dev server on http://localhost:4401
 nx run shared-frontend-ui-components:build-storybook  # static build
 ```
 
diff --git a/libs/domains/shared/frontend/ui-components/project.json b/libs/domains/shared/frontend/ui-components/project.json
index 405430c00..25d220664 100644
--- a/libs/domains/shared/frontend/ui-components/project.json
+++ b/libs/domains/shared/frontend/ui-components/project.json
@@ -34,7 +34,7 @@
     "storybook": {
       "executor": "@storybook/angular:start-storybook",
       "options": {
-        "port": 4400,
+        "port": 4401,
         "configDir": "libs/domains/shared/frontend/ui-components/.storybook",
         "browserTarget": "shared-frontend-ui-components:build-storybook",
         "compodoc": false,
diff --git a/libs/domains/shared/frontend/util-configuration/src/lib/environment.token.spec.ts b/libs/domains/shared/frontend/util-configuration/src/lib/environment.token.spec.ts
index 2975e3ed4..161a0c24a 100644
--- a/libs/domains/shared/frontend/util-configuration/src/lib/environment.token.spec.ts
+++ b/libs/domains/shared/frontend/util-configuration/src/lib/environment.token.spec.ts
@@ -105,7 +105,7 @@ describe('environment.token', () => {
         billing: {
           urls: {
             restApi: 'http://localhost:3200/api',
-            frontend: 'http://localhost:4500',
+            frontend: 'http://localhost:4202',
             websocket: 'http://localhost:3200/socket/billing',
           },
         },
@@ -115,7 +115,7 @@ describe('environment.token', () => {
         landing: {
           urls: {
             restApi: 'http://localhost:3200/api',
-            portal: 'http://localhost:4500',
+            portal: 'http://localhost:4202',
           },
         },
       };
@@ -127,7 +127,7 @@ describe('environment.token', () => {
       expect(billingMerged.billing.tenantId).toBe('acme');
       expect(billingMerged.billing.urls.restApi).toBe('https://backend.example/api');
       expect(billingMerged.billing.urls.websocket).toBe('https://backend.example/socket/billing');
-      expect(billingMerged.billing.urls.frontend).toBe('http://localhost:4500');
+      expect(billingMerged.billing.urls.frontend).toBe('http://localhost:4202');
 
       expect(landingMerged.application.production).toBe(true);
       expect(landingMerged.landing.tenantId).toBe('acme');