diff --git a/cmd/doltsrht/main.go b/cmd/doltsrht/main.go
index 996151c27a7e8d5bd0dc31fd31fb9935da3d58ec..536d4fb86ed1b37192a83a302d10b7c6fcd7eb6c 100644
--- a/cmd/doltsrht/main.go
+++ b/cmd/doltsrht/main.go
@@ -136,7 +136,12 @@ 	conf := config.LoadConfig()
 
 	// server.New parses -b/-d/-m/-p and runs crypto.InitCrypto (needs
 	// [sr.ht]network-key + [webhooks]private-key; missing keys panic here).
-	srv := server.New(serviceName, defaultWebAddr, conf, os.Args[1:])
+	// Pass the full os.Args: core-go's getopt skips argv[0] as the program name
+	// itself (like every upstream sourcehut daemon). Passing os.Args[1:] makes
+	// getopt swallow the first real flag (e.g. -b) as the program name, so the
+	// web bind silently falls back to defaultWebAddr (localhost) — unreachable
+	// from Traefik/other containers.
+	srv := server.New(serviceName, defaultWebAddr, conf, os.Args)
 
 	cfg, err := resolveSettings(conf)
 	if err != nil {