diff --git a/docker-compose.yml b/docker-compose.yml
index f28fb4e..2c36cdb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       AUDIOBOOKS_SSO_URL: ${AUDIOBOOKS_SSO_URL:-}
       VERSE_URL: ${VERSE_URL:-https://versebyversewithnate.us/admin}
       WEBMAIL_URL: ${WEBMAIL_URL:-}                         # optional: a webmail elsewhere; leave empty to use the bundled Cypht below
-      WEBMAIL_BACKEND_URL: http://cypht:80                   # the bundled webmail (Cypht); the hub shows it at /webmail/ (it is not exposed to the internet)
+      WEBMAIL_BACKEND_URL: http://127.0.0.1:80               # the bundled webmail (Cypht, below, shares this container's network); the hub shows it at /webmail/
       CYPHT_USER: ${CYPHT_USER:-hub}                         # the webmail's login; the Mail tab signs in with it for you
       CYPHT_PASSWORD: ${CYPHT_PASSWORD:-}
       PODCAST_URL: ${PODCAST_URL:-https://podcast.necloud.us/}
@@ -29,8 +29,6 @@ services:
       HUB_SETUP_CODE: ${HUB_SETUP_CODE:-}                   # first passkey; if empty, a code is printed in the log
       SESSION_DAYS: ${SESSION_DAYS:-180}                     # how long you stay signed in when idle; using the app renews it
       COOKIE_SECRET: ${COOKIE_SECRET:-}                     # optional; auto-generated and kept in /data if empty
-    depends_on:
-      - cypht
     volumes:
       - hub-data:/data   # passkeys, calendar links and the session secret live here
 
@@ -40,6 +38,10 @@ services:
     image: git.necloud.us/nate/hub-cypht:latest   # built by the Gitea workflow from ./cypht; `docker compose build` builds locally instead
     build: ./cypht
     restart: unless-stopped
+    # Shares the hub's network, so the hub reaches it at 127.0.0.1 whatever network mode or DNS the host uses, and nothing else can reach it.
+    network_mode: "service:hub"
+    depends_on:
+      - hub
     environment:
       AUTH_USERNAME: ${CYPHT_USER:-hub}
       AUTH_PASSWORD: ${CYPHT_PASSWORD:?Choose a password for the webmail and set CYPHT_PASSWORD}   # the hub also uses it to sign you in