diff --git a/servers/bwh-us-dc9/frontdoor/scripts/patch-arcane-compose.sh b/servers/bwh-us-dc9/frontdoor/scripts/patch-arcane-compose.sh
new file mode 100755
index 0000000..7f00c72
--- /dev/null
+++ b/servers/bwh-us-dc9/frontdoor/scripts/patch-arcane-compose.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+set -eu
+
+compose_file=/host-arcane/compose.yml
+backup_file=/host-arcane/compose.yml.pre-haproxy-20260903
+
+test -r "$compose_file"
+test -w "$compose_file"
+
+if [ ! -e "$backup_file" ]; then
+    cp -p "$compose_file" "$backup_file"
+fi
+
+mapping_pattern="^[[:space:]]*-[[:space:]]*['\"]?((0\\.0\\.0\\.0|::):)?443:443(/tcp)?['\"]?[[:space:]]*$"
+mapping_count=$(grep -Ec "$mapping_pattern" "$compose_file" || true)
+
+if [ "$mapping_count" -eq 1 ]; then
+    sed -E -i "\#$mapping_pattern#d" "$compose_file"
+elif [ "$mapping_count" -ne 0 ]; then
+    echo "refusing to patch: expected zero or one TCP 443 mapping, found $mapping_count" >&2
+    exit 1
+fi
+
+if grep -Eq "$mapping_pattern" "$compose_file"; then
+    echo "TCP 443 mapping remains after patch" >&2
+    exit 1
+fi
+
+echo "Arcane Caddy Compose source is backed up and no longer publishes TCP 443"