diff --git a/docker-compose.yml b/docker-compose.yml
index 94d004a..23cf0ef 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,6 +12,7 @@ services:
       - VERSION=${VERSION:-0.0.0}
       - HOST_IP=${HOST_IP:-}
       - TLS_PORT=${TLS_PORT:-8443}   # published port of the proxy's TLS entry (advertised to the app)
+      - HTTP_PORT=${HTTP_PORT:-80}   # published plain-HTTP LAN port (app downloads UI bundles from it)
       - MASTER_USERNAME=${MASTER_USERNAME:-}
       - MASTER_PASSWORD=${MASTER_PASSWORD:-}
     volumes:
diff --git a/local_backend/routers/system.py b/local_backend/routers/system.py
index 779c88f..daf7e78 100644
--- a/local_backend/routers/system.py
+++ b/local_backend/routers/system.py
@@ -1,6 +1,7 @@
 import asyncio
 import ipaddress
 import json
+import os
 import socket
 import time
 from fastapi import APIRouter, Depends, HTTPException, Query
@@ -53,6 +54,9 @@ def identity(db: Session = Depends(get_db)):
         "api_version": API_VERSION,
         # Encrypted LAN endpoint for the native app: https://<ip>:<port>, pin spki_sha256
         "tls": tls_info(),
+        # Plain-HTTP LAN port: the app downloads UI bundles from it (integrity via
+        # the sha256 in the manifest it fetched over TLS)
+        "http_port": int(os.environ.get("HTTP_PORT", "80")),
     }