diff --git a/docker-compose.yml b/docker-compose.yml
index 2ee65a4..8291ec3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,6 +6,9 @@
 # gateway (nginx) ─┬─ site domain  → web (Nuxt SSR)   /api → api   /media → minio
 #                  └─ admin domain → admin (static)   /api → api   /media → minio
 
+# services that other containers reach by name get an imen-* alias: on a shared network (Dokploy) plain
+# names like web or api would also resolve to other stacks' containers
+#
 # fixed project name, so this stack never shares containers or volumes with docker-compose.dev.yml
 name: imen
 
@@ -27,6 +30,9 @@ services:
 
   minio:
     image: docker.arvancloud.ir/minio/minio:latest
+    networks:
+      default:
+        aliases: [imen-minio]
     restart: unless-stopped
     command: server /data
     environment:
@@ -51,6 +57,9 @@ services:
 
   api:
     image: imen-api
+    networks:
+      default:
+        aliases: [imen-api]
     build:
       context: .
       dockerfile: docker/api.Dockerfile
@@ -67,14 +76,14 @@ services:
       JWT_SECRET: ${JWT_SECRET}
       COOKIE_SECURE: ${COOKIE_SECURE:-true}
       TRUST_PROXY: ${TRUST_PROXY:-2}
-      S3_ENDPOINT: http://minio:9000
+      S3_ENDPOINT: http://imen-minio:9000
       S3_BUCKET: ${S3_BUCKET:-imen-media}
       S3_ACCESS_KEY: ${S3_ACCESS_KEY}
       S3_SECRET_KEY: ${S3_SECRET_KEY}
       S3_FORCE_PATH_STYLE: "true"
       S3_ENSURE_BUCKET: "true"
       MEDIA_PUBLIC_URL: /media
-      WEB_REVALIDATE_URL: http://web:3000/_internal/revalidate
+      WEB_REVALIDATE_URL: http://imen-web:3000/_internal/revalidate
       REVALIDATE_SECRET: ${REVALIDATE_SECRET}
       ADMIN_PHONE: ${ADMIN_PHONE}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
@@ -82,6 +91,9 @@ services:
 
   web:
     image: imen-web
+    networks:
+      default:
+        aliases: [imen-web]
     build:
       context: .
       dockerfile: docker/web.Dockerfile
@@ -89,12 +101,15 @@ services:
     depends_on:
       - api
     environment:
-      NUXT_API_INTERNAL_URL: http://api:4000/api
+      NUXT_API_INTERNAL_URL: http://imen-api:4000/api
       NUXT_REVALIDATE_SECRET: ${REVALIDATE_SECRET}
       NUXT_PUBLIC_SITE_URL: https://${SITE_DOMAIN}
 
   admin:
     image: imen-admin
+    networks:
+      default:
+        aliases: [imen-admin]
     build:
       context: .
       dockerfile: docker/admin.Dockerfile
diff --git a/docker/nginx/gateway.conf.template b/docker/nginx/gateway.conf.template
index b773171..31de5f1 100644
--- a/docker/nginx/gateway.conf.template
+++ b/docker/nginx/gateway.conf.template
@@ -2,10 +2,10 @@
 # (only ${SITE_DOMAIN}, ${ADMIN_DOMAIN} and ${S3_BUCKET} are replaced; nginx's own $vars stay).
 # TLS is expected to be terminated in front of this container (host nginx / Traefik / CDN).
 
-upstream web_upstream { server web:3000; }
-upstream api_upstream { server api:4000; }
-upstream admin_upstream { server admin:80; }
-upstream media_upstream { server minio:9000; }
+upstream web_upstream { server imen-web:3000; }
+upstream api_upstream { server imen-api:4000; }
+upstream admin_upstream { server imen-admin:80; }
+upstream media_upstream { server imen-minio:9000; }
 
 # keep the scheme reported by the TLS proxy in front, if any
 map $http_x_forwarded_proto $forwarded_proto {