diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b63a180..ff09962 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -20,7 +20,7 @@ jobs:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: [self-hosted, Linux, X64, arko, typetype]
+    runs-on: [self-hosted, Linux, X64, r730, typetype]
     steps:
       - name: Checkout
         uses: actions/checkout@v7
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 35ca375..5747585 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,9 +14,9 @@ env:
 jobs:
   spelling:
     name: Spell Check with Typos
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || fromJSON('["self-hosted","Linux","X64","arko","typetype"]') }}
+    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || fromJSON('["self-hosted","Linux","X64","r730","typetype"]') }}
     steps:
     - name: Checkout Actions Repository
       uses: actions/checkout@v7
     - name: Spell Check Repo
-      uses: crate-ci/typos@v1.48.0
+      uses: crate-ci/typos@v1.50.0
diff --git a/docs/self-hosting/authentication.md b/docs/self-hosting/authentication.md
index adbd49b..1e6574c 100644
--- a/docs/self-hosting/authentication.md
+++ b/docs/self-hosting/authentication.md
@@ -49,10 +49,11 @@ page. Apply the override with `docker compose up -d --force-recreate typetype-se
 
 ## Redirect URI
 
-Register this callback URL with your provider:
+Register these callback URLs with your provider:
 
 ```text
 https://<your-domain>/auth/oidc/callback
+dev.typetype.android://oidc/callback
 ```
 
 Use your real domain (or `http://localhost:8082/auth/oidc/callback` for a local test).
@@ -72,7 +73,7 @@ Create a confidential client with:
 
 | Pocket ID setting | Value |
 | --- | --- |
-| Callback URL | `https://watch.example.com/auth/oidc/callback` |
+| Callback URL | `https://watch.example.com/auth/oidc/callback` `dev.typetype.android://oidc/callback` |
 | Client launch URL | `https://watch.example.com/` |
 | Public client | off |
 | Requires re-authentication | off |
diff --git a/docs/self-hosting/configuration.md b/docs/self-hosting/configuration.md
index f714e98..2acaa3a 100644
--- a/docs/self-hosting/configuration.md
+++ b/docs/self-hosting/configuration.md
@@ -145,6 +145,7 @@ and SABR endpoints. The following flag controls only interactive remote login:
 | --- | --- | --- |
 | `YOUTUBE_REMOTE_LOGIN_ENABLED` | `false` | Enables the interactive YouTube sign-in flow |
 | `YOUTUBE_OUTBOUND_PROXY_URL` | empty | Optional outbound proxy used for YouTube traffic |
+| `YOUTUBE_REMOTE_LOGIN_CALLBACK_BASE_URL` | `http://localhost:8080` | Internal Server origin that receives the Token completion callback |
 | `YOUTUBE_REMOTE_LOGIN_CALLBACK_ORIGIN` | `http://typetype-server:8080` | Internal callback origin used by Token |
 | `YOUTUBE_REMOTE_LOGIN_TTL_MS` | `480000` | Lifetime requested by Server, clamped to 1–10 minutes |
 | `YOUTUBE_REMOTE_LOGIN_MAX_SESSIONS` | `2` | Concurrent remote browser sessions, clamped to 1–8 |
@@ -155,6 +156,12 @@ Keep the default callback as an internal Server URL. The browser reaches the log
 session through the public web origin and a WebSocket; it does not call that callback
 address directly.
 
+Both callback settings must use the same internal Server origin in a custom Compose
+stack. Set `YOUTUBE_REMOTE_LOGIN_CALLBACK_BASE_URL` on Server and
+`YOUTUBE_REMOTE_LOGIN_CALLBACK_ORIGIN` on Token to the hostname and port that Token
+can reach on the Compose network, for example `http://typetype-server:8080`. Do not
+use the public web URL for either setting.
+
 In the supported Compose file, Token keeps its own eight-minute default cap because
 this TTL variable is passed only to Server. Values above eight minutes therefore do
 not extend the effective reservation without a custom Token configuration.
diff --git a/docs/self-hosting/reverse-proxy.md b/docs/self-hosting/reverse-proxy.md
index 64cad60..98d3195 100644
--- a/docs/self-hosting/reverse-proxy.md
+++ b/docs/self-hosting/reverse-proxy.md
@@ -69,6 +69,67 @@ The app uses WebSockets and accepts large uploads (Takeout imports). If you drop
 break. The settings above match what the bundled web container expects.
 :::
 
+## Option C - Traefik
+
+These examples assume an existing Traefik installation with a `websecure`
+entry point listening on port 443 and an
+[ACME certificate resolver](https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/acme/)
+configured in Traefik's static configuration. Replace `YOUR_CERT_RESOLVER` with
+that resolver's name and `watch.example.com` with your domain. Traefik uses the
+resolver to obtain and renew TLS certificates; the snippets below do not create it.
+
+Attach Traefik and the TypeType web service (`typetype`) to the same Docker network.
+The examples use an existing external network named `proxy`; replace that name
+with your Traefik network. Keep the web service on its existing `default` network
+as well so it can still reach the TypeType server.
+
+For Traefik's Docker provider, merge the following into your Compose configuration:
+
+```yaml
+services:
+  typetype:
+    networks:
+      - default
+      - proxy
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "proxy"
+      traefik.http.services.typetype.loadbalancer.server.port: "80"
+      traefik.http.routers.typetype.service: "typetype"
+      traefik.http.routers.typetype.entrypoints: "websecure"
+      traefik.http.routers.typetype.rule: "Host(`watch.example.com`)"
+      traefik.http.routers.typetype.tls: "true"
+      traefik.http.routers.typetype.tls.certresolver: "YOUR_CERT_RESOLVER"
+
+networks:
+  proxy:
+    external: true
+```
+
+Alternatively, keep the same network attachments and use this dynamic YAML
+configuration with Traefik's file provider instead of the labels:
+
+```yaml
+http:
+  routers:
+    typetype:
+      entryPoints:
+        - websecure
+      rule: 'Host(`watch.example.com`)'
+      service: typetype
+      tls:
+        certResolver: YOUR_CERT_RESOLVER
+
+  services:
+    typetype:
+      loadBalancer:
+        servers:
+          - url: http://typetype:80
+```
+
+The web container serves plain HTTP on port 80; Traefik terminates HTTPS.
+Enable the Docker or file provider in Traefik according to the example you choose.
+
 ## Remote login and WebSockets
 
 Interactive YouTube login starts with a normal HTTP request, then opens a WebSocket