diff --git a/.env.prod.example b/.env.prod.example
index c59e4fc..f390ca7 100644
--- a/.env.prod.example
+++ b/.env.prod.example
@@ -19,6 +19,7 @@ ZITADEL_MASTERKEY=CHANGE_ME_32_CHARACTERS_EXACTLY_
 ZITADEL_EXTERNAL_DOMAIN=auth.example.com
 ZITADEL_EXTERNAL_PORT=443
 ZITADEL_EXTERNAL_SECURE=true
+ZITADEL_TLS_MODE=external
 ZITADEL_DATABASE_PASSWORD=CHANGE_ME
 ZITADEL_ADMIN_USERNAME=admin
 ZITADEL_ADMIN_PASSWORD=CHANGE_ME
diff --git a/compose.yml b/compose.yml
index 9dbf618..3f09dc3 100644
--- a/compose.yml
+++ b/compose.yml
@@ -47,7 +47,10 @@ services:
   zitadel:
     image: ghcr.io/zitadel/zitadel:latest
     container_name: infra-zitadel
-    command: start-from-init --masterkeyFromEnv --tlsMode disabled
+    # `disabled` (dev, plain http) makes Zitadel advertise http URLs; behind a
+    # TLS-terminating proxy it must be `external` or the console calls
+    # http://<domain> and the CSP blocks it.
+    command: start-from-init --masterkeyFromEnv --tlsMode ${ZITADEL_TLS_MODE:-disabled}
     environment:
       ZITADEL_MASTERKEY: ${ZITADEL_MASTERKEY}
       # The external domain/port form the token issuer and must be identical