diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index efe1a637..23ca73e9 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -574,6 +574,32 @@ jobs:
             -e TINYCLOUD_KEYS__TYPE \
             "${IMAGE}" --validate-config
 
+      # TC-1012: this compose no longer publishes :8000, so the gateway stops
+      # serving <app_id>-8000. node.tinycloud.xyz (the SDK default) must already
+      # go through dstack-ingress, or replacing the CVM takes it down. Only the
+      # ingress serves /evidences/ (the node itself returns 404), so a 404 here
+      # means the worker still points at the raw port: refuse before touching
+      # the CVM. Any other non-200 (e.g. a broken ingress) only warns, so the
+      # gate cannot block the redeploy that fixes it.
+      - name: Require node.tinycloud.xyz to route through the ingress
+        run: |
+          set -euo pipefail
+          STATUS="000"
+          for attempt in 1 2 3; do
+            STATUS="$(curl -sS --max-time 15 -o /dev/null -w '%{http_code}' https://node.tinycloud.xyz/evidences/ || true)"
+            if [ "${STATUS}" = "200" ]; then
+              echo "node.tinycloud.xyz routes through the ingress (/evidences/ 200)."
+              exit 0
+            fi
+            if [ "${STATUS}" = "404" ]; then
+              echo "::error::TC-1012: node.tinycloud.xyz still bypasses the ingress (/evidences/ HTTP 404); deploy the tinycloud-dev worker repoint (samgbafa/tinycloud-dev#83) first"
+              exit 1
+            fi
+            echo "attempt ${attempt}/3: node.tinycloud.xyz/evidences/ returned HTTP ${STATUS}"
+            [ "${attempt}" = 3 ] || sleep 5
+          done
+          echo "::warning::TC-1012: node.tinycloud.xyz/evidences/ returned HTTP ${STATUS} (no 200, no raw-port 404 in 3 attempts); proceeding with deploy"
+
       - name: Deploy to Phala Cloud
         env:
           PHALA_CLOUD_API_KEY: ${{ secrets.PHALA_CLOUD_API_KEY }}
@@ -759,3 +785,42 @@ jobs:
             echo "${route}: mounted (HTTP ${STATUS})"
             rm -f "${RESPONSE_FILE}"
           done
+
+      # TC-1012: the node's :8000 must only be reachable through dstack-ingress.
+      # If the compose publishes it, the Phala gateway serves it directly at
+      # <app_id>-8000.<gateway_domain> and bypasses the ingress limits/logs.
+      # A closed port makes the gateway accept TLS and then close the stream
+      # (curl exit 52/56, no HTTP status). Other curl errors prove nothing.
+      - name: Verify app port is not exposed by the Phala gateway
+        run: |
+          set -euo pipefail
+          # tinycloud-node prod CVM app_id on dstack-pha-prod5.
+          RAW_URL="https://350d124c81d53a57e8899e9f85a904918e663b61-8000.dstack-pha-prod5.phala.network/version"
+          INGRESS_STATUS="$(curl -sS --max-time 15 -o /dev/null -w '%{http_code}' https://tee.node.tinycloud.xyz/version || true)"
+          if [ "${INGRESS_STATUS}" != "200" ]; then
+            echo "::error::TC-1012: https://tee.node.tinycloud.xyz/version returned HTTP ${INGRESS_STATUS}, expected 200 via dstack-ingress."
+            exit 1
+          fi
+          CLOSED=0
+          RC=0
+          for attempt in $(seq 1 10); do
+            RC=0
+            RAW_STATUS="$(curl -sS --max-time 15 -o /dev/null -w '%{http_code}' "${RAW_URL}" 2>/tmp/tc1012-curl.err)" || RC=$?
+            if [ "${RAW_STATUS}" != "000" ]; then
+              echo "::error::TC-1012: ${RAW_URL} returned HTTP ${RAW_STATUS}; port 8000 is published and bypasses dstack-ingress."
+              exit 1
+            fi
+            if [ "${RC}" = 52 ] || [ "${RC}" = 56 ]; then
+              CLOSED=$((CLOSED + 1))
+              [ "${CLOSED}" -ge 3 ] && break
+            else
+              echo "TC-1012 probe inconclusive (curl exit ${RC}): $(cat /tmp/tc1012-curl.err)"
+              CLOSED=0
+            fi
+            sleep 5
+          done
+          if [ "${CLOSED}" -lt 3 ]; then
+            echo "::error::TC-1012: could not confirm ${RAW_URL} is closed (last curl exit ${RC})."
+            exit 1
+          fi
+          echo "Ingress serves /version (200); gateway app port 8000 is closed (curl exit ${RC}, ${CLOSED} consecutive)."
diff --git a/docker-compose.dstack-postgres.yaml b/docker-compose.dstack-postgres.yaml
index 9afa4196..2792f6e1 100644
--- a/docker-compose.dstack-postgres.yaml
+++ b/docker-compose.dstack-postgres.yaml
@@ -21,8 +21,10 @@ services:
       options:
         max-size: "50m"
         max-file: "3"
-    ports:
-      - "8000:8000"
+    # TC-1012: no `ports:` on purpose. A published port is served by the Phala
+    # gateway at https://<app_id>-8000.<gateway>/, bypassing dstack-ingress
+    # (header/body limits, redacted access log, our TLS). The ingress reaches
+    # the node over the compose network at http://tinycloud:8000.
     volumes:
       - /var/run/dstack.sock:/var/run/dstack.sock
     environment: