diff --git a/docker-compose.yml b/docker-compose.yml
index 76abfb7..d48a04d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -25,11 +25,10 @@ services:
     privileged: true                               # ARIAs Wohnung — sie hat die Schlüssel
     depends_on:
       - proxy
-    ports:
-      - "3001:3001"                                # Diagnostic Web-UI (laeuft im shared network)
     environment:
       - CANVAS_HOST=127.0.0.1
       - OPENCLAW_GATEWAY_TOKEN=${ARIA_AUTH_TOKEN}
+      - OPENCLAW_GATEWAY_BIND=0.0.0.0
       - DEFAULT_MODEL=proxy/claude-sonnet-4
       - RATE_LIMIT_PER_USER=30
       - DISPLAY=:0
@@ -52,7 +51,6 @@ services:
     container_name: aria-bridge
     depends_on:
       - aria
-    network_mode: "service:aria"                   # Teilt Netzwerk mit aria-core → localhost:18789 erreichbar
     volumes:
       - ./aria-data/voices:/voices:ro              # TTS Stimmen
       - ./aria-data/config/aria.env:/config/aria.env
@@ -63,6 +61,7 @@ services:
       - /dev/snd
     environment:
       - PULSE_SERVER=unix:/run/user/1000/pulse/native
+      - ARIA_CORE_WS=ws://aria:18789              # Gateway über aria-net (nicht localhost)
       - ARIA_AUTH_TOKEN=${ARIA_AUTH_TOKEN:-}
       - RVS_HOST=${RVS_HOST:-}
       - RVS_PORT=${RVS_PORT:-443}
@@ -70,6 +69,8 @@ services:
       - RVS_TLS_FALLBACK=${RVS_TLS_FALLBACK:-true}
       - RVS_TOKEN=${RVS_TOKEN:-}
     restart: unless-stopped
+    networks:
+      - aria-net
 
   # ─── Diagnostic (Selbstcheck-UI) ──────────────────────
   diagnostic:
@@ -77,10 +78,12 @@ services:
     container_name: aria-diagnostic
     depends_on:
       - aria
-    network_mode: "service:aria"                   # Teilt Netzwerk mit aria-core → localhost:18789
+    ports:
+      - "3001:3001"                                # Diagnostic Web-UI
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     environment:
+      - ARIA_CORE_WS=ws://aria:18789              # Gateway über aria-net (nicht localhost)
       - ARIA_AUTH_TOKEN=${ARIA_AUTH_TOKEN:-}
       - PROXY_URL=http://proxy:3456
       - RVS_HOST=${RVS_HOST:-}
@@ -89,6 +92,8 @@ services:
       - RVS_TLS_FALLBACK=${RVS_TLS_FALLBACK:-true}
       - RVS_TOKEN=${RVS_TOKEN:-}
     restart: unless-stopped
+    networks:
+      - aria-net
 
 volumes:
   openclaw-config:                                 # Persistiert ~/.openclaw (Model, Auth, Sessions)