diff --git a/Dockerfile b/Dockerfile
index 8fed2f0b..56ade660 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -110,8 +110,15 @@ USER appuser
 # Install Playwright Chromium as appuser (so browsers are in correct location)
 RUN python -m playwright install chromium
 
-# Expose the public port (backend remains internal on 8000)
-EXPOSE 3000
+# Configurable ports (override at build time with --build-arg)
+ARG FRONTEND_PORT=3000
+ARG BACKEND_PORT=8000
+# Persist as ENV so HEALTHCHECK resolves the port at runtime
+ENV FRONTEND_PORT=${FRONTEND_PORT} \
+    BACKEND_PORT=${BACKEND_PORT}
+
+# Expose the public port (backend remains internal)
+EXPOSE ${FRONTEND_PORT}
 
 # Volume for persistent data
 VOLUME ["/app/backend/data"]
@@ -121,7 +128,7 @@ WORKDIR /app
 
 # Health check on internal backend port only (independent of host port mapping).
 HEALTHCHECK --interval=10s --timeout=10s --start-period=30s --retries=5 \
-    CMD curl -f http://127.0.0.1:8000/api/v1/health || exit 1
+    CMD curl -f http://127.0.0.1:${BACKEND_PORT}/api/v1/health || exit 1
 
 # Start the application
 CMD ["/app/start.sh"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 07589f66..a671b39b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,12 +4,18 @@ services:
     build: .
     container_name: resume-matcher
     ports:
-      - "${PORT:-3000}:3000"
+      - "${PORT:-3000}:${FRONTEND_PORT:-3000}"
     volumes:
       - resume-data:/app/backend/data
     #secrets:
     #  - llm_api_key
     environment:
+      # Internal container ports (default: 3000 frontend, 8000 backend)
+      # Note: changing BACKEND_PORT also requires rebuilding the image
+      # (--build-arg BACKEND_PORT=... and BACKEND_ORIGIN=http://127.0.0.1:<port>)
+      # for the Next.js proxy rewrites to match.
+      - FRONTEND_PORT=${FRONTEND_PORT:-3000}
+      - BACKEND_PORT=${BACKEND_PORT:-8000}
       # domain in reverse proxy
       - FRONTEND_BASE_URL=${FRONTEND_BASE_URL:-http://localhost:3000}
       # Logging configuration: DEBUG, INFO, WARNING, ERROR
diff --git a/docker/start.sh b/docker/start.sh
index e5475e18..98490d17 100644
--- a/docker/start.sh
+++ b/docker/start.sh
@@ -11,8 +11,9 @@ NC='\033[0m' # No Color
 BOLD='\033[1m'
 
 # Internal port configuration for single-port deployment.
-FRONTEND_PORT="3000"
-BACKEND_PORT="8000"
+# Override via environment variables (e.g. docker run -e FRONTEND_PORT=4000).
+FRONTEND_PORT="${FRONTEND_PORT:-3000}"
+BACKEND_PORT="${BACKEND_PORT:-8000}"
 
 # Print banner
 print_banner() {