diff --git a/Dockerfile.production b/Dockerfile.production
index 4b1bee3..6ca3772 100644
--- a/Dockerfile.production
+++ b/Dockerfile.production
@@ -8,6 +8,20 @@ COPY package.json package-lock.json turbo.json tsconfig.base.json ./
 COPY apps ./apps
 COPY packages ./packages
 
+# NEXT_PUBLIC_* vars must be present at build time — they are inlined into JS bundles
+ARG NEXT_PUBLIC_API_URL
+ARG NEXT_PUBLIC_MARKETING_URL
+ARG NEXT_PUBLIC_MARKETPLACE_URL
+ARG NEXT_PUBLIC_DASHBOARD_URL
+ARG NEXT_PUBLIC_ADMIN_URL
+ARG NEXT_PUBLIC_PUBLIC_SITE_DOMAIN
+ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL \
+    NEXT_PUBLIC_MARKETING_URL=$NEXT_PUBLIC_MARKETING_URL \
+    NEXT_PUBLIC_MARKETPLACE_URL=$NEXT_PUBLIC_MARKETPLACE_URL \
+    NEXT_PUBLIC_DASHBOARD_URL=$NEXT_PUBLIC_DASHBOARD_URL \
+    NEXT_PUBLIC_ADMIN_URL=$NEXT_PUBLIC_ADMIN_URL \
+    NEXT_PUBLIC_PUBLIC_SITE_DOMAIN=$NEXT_PUBLIC_PUBLIC_SITE_DOMAIN
+
 RUN npm install
 RUN npm run db:generate
 RUN npm run build
diff --git a/docker-compose.production.yml b/docker-compose.production.yml
index 1f334a8..c844af4 100644
--- a/docker-compose.production.yml
+++ b/docker-compose.production.yml
@@ -56,6 +56,13 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.production
+      args:
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
+        NEXT_PUBLIC_MARKETING_URL: ${NEXT_PUBLIC_MARKETING_URL}
+        NEXT_PUBLIC_MARKETPLACE_URL: ${NEXT_PUBLIC_MARKETPLACE_URL}
+        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
+        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
+        NEXT_PUBLIC_PUBLIC_SITE_DOMAIN: ${NEXT_PUBLIC_PUBLIC_SITE_DOMAIN}
     command:
       - bash
       - -c
@@ -75,14 +82,8 @@ services:
     restart: unless-stopped
     labels:
       - traefik.enable=true
-      # public-site (port 3003)
-      - traefik.http.routers.homepage.rule=Host(`rentaldrivego.ma`) || Host(`www.rentaldrivego.ma`)
-      - traefik.http.routers.homepage.entrypoints=websecure
-      - traefik.http.routers.homepage.tls.certresolver=letsencrypt
-      - traefik.http.routers.homepage.service=public-site-svc
-      - traefik.http.services.public-site-svc.loadbalancer.server.port=3003
-      # marketplace (port 3000)
-      - traefik.http.routers.marketplace.rule=Host(`${MARKETPLACE_DOMAIN}`)
+      # marketplace (port 3000) — owns both bare and www domains
+      - traefik.http.routers.marketplace.rule=Host(`rentaldrivego.ma`) || Host(`www.rentaldrivego.ma`)
       - traefik.http.routers.marketplace.entrypoints=websecure
       - traefik.http.routers.marketplace.tls.certresolver=letsencrypt
       - traefik.http.routers.marketplace.service=marketplace-svc