diff --git a/MQTT_DEVICE_AUTH.md b/MQTT_DEVICE_AUTH.md
index aafdebf..880da25 100644
--- a/MQTT_DEVICE_AUTH.md
+++ b/MQTT_DEVICE_AUTH.md
@@ -12,7 +12,7 @@ exposes three listeners, each with a different trust model:
 
 | Port | Protocol | Auth | Who it's for |
 |------|----------|------|---------------|
-| `1883` | MQTT (plaintext) | username/password | internal services (e.g. the Laravel subscriber, Python publisher) |
+| `1883` | MQTT (plaintext, Compose network only) | username/password | internal backend service; not host-published |
 | `8883` | MQTT over TLS | **client certificate** | field devices |
 | `443` (`/mqtt` → loopback `9001`) | MQTT over WSS/TLS | username/password | scoped app clients |
 | `8884` | MQTT over TLS | username/password (server cert only) | scoped app clients and administrators on networks that expose the raw port |
diff --git a/docker-compose.yml b/docker-compose.yml
index d535bb2..73e769c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,7 +11,6 @@ services:
   mosquitto:
     image: eclipse-mosquitto:2
     ports:
-      - "1883:1883"
       - "8883:8883"
       - "8884:8884"
       - "127.0.0.1:9001:9001"