diff --git a/compose.deploy.yml b/compose.deploy.yml
index 175e94a..bb08e55 100644
--- a/compose.deploy.yml
+++ b/compose.deploy.yml
@@ -16,6 +16,8 @@ services:
     pull_policy: always
     ports:
       - "5000:5000"
+    networks:
+      - backend
     volumes:
       # /data holds the auto-generated secret key, third-party plugins, and the
       # Ansible playbook cache — all of which must survive image updates. No
@@ -33,13 +35,15 @@ services:
 
   db:
     image: postgres:16-alpine
+    networks:
+      - backend
     environment:
       POSTGRES_USER: steward
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-steward}
       POSTGRES_DB: steward
     volumes:
       - pgdata:/var/lib/postgresql/data
-    # No host port published — Postgres is reachable only on the compose network.
+    # No host port published — db is reachable only on the backend network.
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U steward"]
       interval: 5s
@@ -47,6 +51,9 @@ services:
       retries: 5
     restart: unless-stopped
 
+networks:
+  backend:
+
 volumes:
   pgdata:
   app_data: