diff --git a/servers/bwh-us-dc9/frontdoor/.env.example b/servers/bwh-us-dc9/frontdoor/.env.example
index db71747..7ec3327 100644
--- a/servers/bwh-us-dc9/frontdoor/.env.example
+++ b/servers/bwh-us-dc9/frontdoor/.env.example
@@ -1,3 +1,2 @@
-# Stage on 8444 first. Change to 443 only after the Arcane Agent Caddy is
-# reachable through its temporary management port and host TCP 443 is free.
-HAPROXY_PUBLIC_PORT=8444
+# HAProxy owns public TCP 443. Hysteria2 owns public UDP 443 separately.
+HAPROXY_PUBLIC_PORT=443
diff --git a/servers/bwh-us-dc9/frontdoor/README.md b/servers/bwh-us-dc9/frontdoor/README.md
index 7eea090..a59f574 100644
--- a/servers/bwh-us-dc9/frontdoor/README.md
+++ b/servers/bwh-us-dc9/frontdoor/README.md
@@ -7,6 +7,6 @@ HAProxy inspects TCP SNI without terminating TLS:
 - `dc9.kais.cloud` -> the existing Arcane Agent Caddy on `arcane_default`
 - unmatched SNI -> the dedicated Caddy fallback serving `dc9.opfo.xyz`
 
-The first deployment uses host TCP 8444. Moving it to TCP 443 requires a staged
-handoff from the existing Arcane Agent Caddy so the Direct HTTPS management path
-remains reachable throughout the change.
+HAProxy publishes host TCP 443. The existing Arcane Agent Caddy remains attached
+to `arcane_default` without a host TCP 443 binding and receives
+`dc9.kais.cloud` traffic from HAProxy.
diff --git a/servers/bwh-us-dc9/frontdoor/compose.yaml b/servers/bwh-us-dc9/frontdoor/compose.yaml
index c17ad3f..2b3bd16 100644
--- a/servers/bwh-us-dc9/frontdoor/compose.yaml
+++ b/servers/bwh-us-dc9/frontdoor/compose.yaml
@@ -4,7 +4,7 @@ services:
     container_name: dc9-haproxy
     restart: unless-stopped
     ports:
-      - "${HAPROXY_PUBLIC_PORT:-8444}:8443/tcp"
+      - "${HAPROXY_PUBLIC_PORT:-443}:8443/tcp"
     extra_hosts:
       - "host.docker.internal:host-gateway"
     depends_on: