diff --git a/web-player/.env.example b/web-player/.env.example
index 5fc0011..7430bd4 100644
--- a/web-player/.env.example
+++ b/web-player/.env.example
@@ -1,3 +1,6 @@
+# Local configuration for `npm run dev`. deploy/zitadel/provision.ps1 fills in
+# the Zitadel values; in Docker the same variables come from deploy/compose.yml.
+
 # Zitadel OIDC (server-side auth)
 ZITADEL_ISSUER=http://host.docker.internal:8080
 ZITADEL_CLIENT_ID=your-web-app-client-id
@@ -10,6 +13,9 @@ AUTH_POST_LOGOUT_URI=http://localhost:5173/
 # Secret used to derive the session cookie encryption key (any long random string)
 SESSION_SECRET=change-me-to-a-long-random-string
 
+# Backend API base URL
+API_BASE_URL=http://localhost:5111
+
 # Optional session tuning (defaults shown)
 # OIDC_SCOPE=openid profile email offline_access
 # SESSION_TTL_SECONDS=604800
@@ -19,5 +25,7 @@ SESSION_SECRET=change-me-to-a-long-random-string
 # Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer).
 # AUTH_ALLOW_INSECURE_HTTP=true
 
-# Backend API base URL (used from later parts)
-API_BASE_URL=http://localhost:5111
+# Where to send presigned S3 PUTs when the public S3 host is not reachable from
+# the server (in Docker: http://seaweedfs:8333). The signed Host header is kept
+# either way. Defaults to the host in the presigned URL.
+# S3_UPLOAD_ENDPOINT=http://localhost:8333
diff --git a/web-player/src/lib/server/upload.ts b/web-player/src/lib/server/upload.ts
index 18f78a0..c21ce52 100644
--- a/web-player/src/lib/server/upload.ts
+++ b/web-player/src/lib/server/upload.ts
@@ -2,7 +2,7 @@ import http from 'node:http';
 import https from 'node:https';
 import { env } from '$env/dynamic/private';
 
-const CONNECT_HOST = env.S3_UPLOAD_CONNECT_HOST || '127.0.0.1';
+const UPLOAD_ENDPOINT = env.S3_UPLOAD_ENDPOINT ?? '';
 
 export const IMAGE_TYPES: Record<string, string> = {
 	jpg: 'image/jpeg',
@@ -48,14 +48,15 @@ export async function putPresigned(
 	if (signed.has('content-type')) headers['Content-Type'] = contentType;
 	if (signed.has('if-none-match')) headers['If-None-Match'] = '*';
 
-	const secure = url.protocol === 'https:';
+	const target = UPLOAD_ENDPOINT ? new URL(UPLOAD_ENDPOINT) : url;
+	const secure = target.protocol === 'https:';
 	const transport = secure ? https : http;
-	const port = url.port || (secure ? 443 : 80);
+	const port = target.port || (secure ? 443 : 80);
 
 	await new Promise<void>((resolve, reject) => {
 		const request = transport.request(
 			{
-				host: CONNECT_HOST,
+				host: target.hostname,
 				port,
 				method: 'PUT',
 				path: url.pathname + url.search,