diff --git a/headscale/config.yaml b/headscale/config.yaml
index 7cbbbe9..ceef727 100644
--- a/headscale/config.yaml
+++ b/headscale/config.yaml
@@ -69,6 +69,9 @@ dns:
     - name: "pulsenode.pivoine.art"
       type: "A"
       value: "100.64.0.3"
+    - name: "traefik.pivoine.art"
+      type: "A"
+      value: "100.64.0.3"
 
 # TLS is terminated by Traefik; headscale itself serves plain HTTP internally.
 tls_letsencrypt_hostname: ""
diff --git a/traefik/compose.yml b/traefik/compose.yml
index 4ad76ca..b6034a9 100644
--- a/traefik/compose.yml
+++ b/traefik/compose.yml
@@ -40,6 +40,19 @@ services:
       timeout: 5s
       retries: 3
       start_period: 10s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${NETWORK_NAME}"
+      - "traefik.http.middlewares.traefik-redirect-web-secure.redirectscheme.scheme=https"
+      - "traefik.http.routers.traefik-dashboard-web.rule=Host(`traefik.pivoine.art`)"
+      - "traefik.http.routers.traefik-dashboard-web.entrypoints=web"
+      - "traefik.http.routers.traefik-dashboard-web.middlewares=traefik-redirect-web-secure"
+      - "traefik.http.routers.traefik-dashboard-web.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard-web-secure.rule=Host(`traefik.pivoine.art`)"
+      - "traefik.http.routers.traefik-dashboard-web-secure.entrypoints=web-secure"
+      - "traefik.http.routers.traefik-dashboard-web-secure.tls.certresolver=resolver"
+      - "traefik.http.routers.traefik-dashboard-web-secure.middlewares=vpn-only@file,security-headers@file,no-index@file"
+      - "traefik.http.routers.traefik-dashboard-web-secure.service=api@internal"
     networks:
       - compose_network
       - coolify_network
diff --git a/traefik/dynamic/dashboard.yaml b/traefik/dynamic/dashboard.yaml
deleted file mode 100644
index 383711f..0000000
--- a/traefik/dynamic/dashboard.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-# Exposes Traefik's own API/dashboard (api@internal is a built-in service,
-# not something defined below) on traefik.pivoine.art, gated by vpn-only.
-# Path prefixes match Traefik's own documented self-referencing pattern:
-# /api serves the JSON pulsenode's traefik widget reads, /dashboard serves
-# the browsable UI.
-http:
-  middlewares:
-    traefik-redirect-web-secure:
-      redirectScheme:
-        scheme: https
-
-  routers:
-    traefik-dashboard-web:
-      rule: "Host(`traefik.pivoine.art`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
-      entrypoints:
-        - web
-      middlewares:
-        - vpn-only@file
-        - traefik-redirect-web-secure
-      service: api@internal
-
-    traefik-dashboard-web-secure:
-      rule: "Host(`traefik.pivoine.art`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
-      entrypoints:
-        - web-secure
-      tls:
-        certResolver: resolver
-      middlewares:
-        - vpn-only@file
-        - security-headers@file
-        - no-index@file
-      service: api@internal