diff --git a/docker-compose.yml b/docker-compose.yml
index e2dc484..d837f7e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,14 +1,21 @@
 services:
   server:
-    image: docker.io/actualbudget/actual-server:25.2.1@sha256:3abc61d5f674a1043a93e448930142ce955b5e3938ee93e01f013c7d7d6f27d7
-    ports:
-      - '5006:5006'
+    image: docker.io/actualbudget/actual-server:25.6.1@sha256:cb23c488bb517550dea10f42ae9a69c2e746fc2736b068e8c4cc2a224641222f
     environment:
       - ACTUAL_LOGIN_METHOD=openid
       - ACTUAL_OPENID_DISCOVERY_URL=${DC_ACTUAL_OPENID_DISCOVERY_URL:?}
       - ACTUAL_OPENID_CLIENT_ID=${DC_ACTUAL_OPENID_CLIENT_ID:?}
       - ACTUAL_OPENID_CLIENT_SECRET=${DC_ACTUAL_OPENID_CLIENT_SECRET:?}
-      - ACTUAL_OPENID_SERVER_HOSTNAME=https://${DC_ACTUAL_HOSTNAME:?}/
+      - ACTUAL_OPENID_SERVER_HOSTNAME=https://${DC_ACTUAL_HOSTNAME:?}
+      - ACTUAL_OPENID_ENFORCE=true
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.actual.rule=Host(`${DC_ACTUAL_HOSTNAME:?}`)"
+      - "traefik.http.routers.actual.entrypoints=websecure"
+      - "traefik.http.services.actual.loadbalancer.server.port=${DC_ACTUAL_PORT:?}"
+    networks:
+      - traefik
+
     volumes:
       - data:/data
     healthcheck:
@@ -22,3 +29,7 @@ services:
 
 volumes:
   data:
+
+networks:
+  traefik:
+    external: true
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..74c32f3
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,7 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>renovate/renovate"
+  ],
+  "ignoreTests": true
+}