diff --git a/docker-compose.yml b/docker-compose.yml
index 68748caa..c697278b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -79,12 +79,13 @@ services:
     restart: always
     depends_on:
       - server-gunicorn
+    user: 101:999
     links:
       - db
     networks:
       - merginmaps
   proxy:
-    image: nginxinc/nginx-unprivileged:1.25.5
+    image: nginxinc/nginx-unprivileged:1.27
     container_name: merginmaps-proxy
     restart: always
     # run nginx as built-in user but with group mergin-family for files permissions
diff --git a/nginx.conf b/nginx.conf
index ed4512ad..598b8e3e 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -17,7 +17,7 @@ server {
      # we don't want nginx trying to do something clever with
      # redirects, we set the Host: header above already.
      proxy_redirect off;
-     proxy_pass http://merginmaps-web;
+     proxy_pass http://merginmaps-web:8080;
    }
 
    # proxy to backend
diff --git a/web-app/Dockerfile b/web-app/Dockerfile
index dfa28896..38bc206a 100644
--- a/web-app/Dockerfile
+++ b/web-app/Dockerfile
@@ -9,7 +9,7 @@ RUN yarn link:dependencies
 RUN yarn build:all
 RUN PUBLIC_PATH=/admin/ yarn build:all:admin
 
-FROM nginxinc/nginx-unprivileged:1.25.5
+FROM nginxinc/nginx-unprivileged:1.27
 MAINTAINER Martin Varga "martin.varga@lutraconsulting.co.uk"
 WORKDIR /usr/share/nginx/html
 # client app
@@ -18,4 +18,5 @@ COPY --from=builder /mergin/web-app/packages/app/dist ./app
 COPY --from=builder /mergin/web-app/packages/admin-app/dist ./admin
 # basic nginx config to serve static files
 COPY ./nginx.proxy.conf /etc/nginx/conf.d/default.conf
+EXPOSE 8080
 ENTRYPOINT ["nginx", "-g", "daemon off;"]
diff --git a/web-app/nginx.proxy.conf b/web-app/nginx.proxy.conf
index 43c9beef..05c4bd06 100644
--- a/web-app/nginx.proxy.conf
+++ b/web-app/nginx.proxy.conf
@@ -1,5 +1,6 @@
 server {
-  listen 80;
+  listen 8080;
+  listen [::]:8080;
   client_max_body_size 4G;
 
   location / {