diff --git a/config.env b/config.env
index 9aa83bc..c56db0c 100644
--- a/config.env
+++ b/config.env
@@ -27,6 +27,11 @@ STORAGE_PATH_USE_TMP_FOLDER=false
 
 # Listen address and port. Bound to localhost by default — runners
 # reach the host via host.containers.internal (Podman) on this port.
+#
+# Container: HOST is overridden to 0.0.0.0 by the quadlet. Set the host
+# listen address in PublishPort instead, and keep PORT in sync with the
+# container side of PublishPort:
+#   /etc/containers/systemd/turborepo-remote-cache.container.d/publish-port.conf
 HOST=127.0.0.1
 PORT=3128
 
diff --git a/publish-port.conf b/publish-port.conf
new file mode 100644
index 0000000..72ca0b2
--- /dev/null
+++ b/publish-port.conf
@@ -0,0 +1,9 @@
+# Host port mapping for the turborepo-remote-cache quadlet.
+# The container side must match PORT in /etc/turborepo-remote-cache/config.env.
+# Apply changes with:
+#
+#   systemctl daemon-reload
+#   systemctl restart turborepo-remote-cache.service
+
+[Container]
+PublishPort=127.0.0.1:3128:3128
diff --git a/turborepo-remote-cache.container b/turborepo-remote-cache.container
index 9111ff8..700be1d 100644
--- a/turborepo-remote-cache.container
+++ b/turborepo-remote-cache.container
@@ -8,8 +8,8 @@ Wants=network-online.target
 ContainerName=turborepo-remote-cache
 Image=docker.io/ducktors/turborepo-remote-cache:2.14.1
 EnvironmentFile=/etc/turborepo-remote-cache/config.env
-# Bind to loopback on the host; runners reach via host.containers.internal
-PublishPort=127.0.0.1:3128:3000
+# PublishPort lives in
+# /etc/containers/systemd/turborepo-remote-cache.container.d/publish-port.conf
 # :U chowns the host dir to the container's "app" user on start
 Volume=/var/cache/turborepo-remote-cache:/app/cache:Z,U
 # Override STORAGE_PATH inside the container to match the bind mount.
@@ -18,7 +18,6 @@ Volume=/var/cache/turborepo-remote-cache:/app/cache:Z,U
 # to the ephemeral /tmp/app/cache instead of the bind mount.
 Environment=STORAGE_PATH=/app/cache
 Environment=STORAGE_PATH_USE_TMP_FOLDER=false
-Environment=PORT=3000
 Environment=HOST=0.0.0.0
 
 [Service]
diff --git a/turborepo-remote-cache.spec b/turborepo-remote-cache.spec
index e581b3c..301e09d 100644
--- a/turborepo-remote-cache.spec
+++ b/turborepo-remote-cache.spec
@@ -10,7 +10,7 @@
 
 Name:           turborepo-remote-cache
 Version:        2.14.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Self-hosted Turborepo remote cache server
 License:        MIT
 Group:          Development/Tools
@@ -22,6 +22,7 @@ Source10:       %{name}.sysusers
 Source11:       %{name}.service
 Source12:       %{name}.container
 Source13:       config.env
+Source14:       publish-port.conf
 
 BuildArch:      noarch
 
@@ -119,6 +120,8 @@ install -p -D -m 644 %{SOURCE11} %{buildroot}%{_unitdir}/%{name}.service
 # -container: quadlet
 install -p -D -m 644 %{SOURCE12} \
     %{buildroot}%{_datadir}/containers/systemd/%{name}.container
+install -p -D -m 644 %{SOURCE14} \
+    %{buildroot}%{_sysconfdir}/containers/systemd/%{name}.container.d/publish-port.conf
 
 %pre
 %sysusers_create_package %{name} %{SOURCE10}
@@ -155,8 +158,16 @@ install -p -D -m 644 %{SOURCE12} \
 %files container
 %defattr(-,root,root,-)
 %{_datadir}/containers/systemd/%{name}.container
+%dir %{_sysconfdir}/containers/systemd/%{name}.container.d
+%config(noreplace) %{_sysconfdir}/containers/systemd/%{name}.container.d/publish-port.conf
 
 %changelog
+* Thu Oct 29 2026 Zoran Pericic <zpericic@netst.org> - 2.14.1-2
+- Container respects PORT from config.env: drop the PORT=3000 override
+  and publish 127.0.0.1:3128:3128
+- Move PublishPort to a %%config(noreplace) quadlet drop-in at
+  /etc/containers/systemd/turborepo-remote-cache.container.d/publish-port.conf
+
 * Thu Oct 01 2026 Zoran Pericic <zpericic@netst.org> - 2.14.1-1
 - Update to 2.14.1
 - Storage backend failures surface as 5xx instead of cache miss;