diff --git a/deploy/systemd/docker.service.d/mealquest-firewall.conf b/deploy/systemd/docker.service.d/mealquest-firewall.conf
new file mode 100644
index 0000000..afe3355
--- /dev/null
+++ b/deploy/systemd/docker.service.d/mealquest-firewall.conf
@@ -0,0 +1,3 @@
+# Re-apply the MealQuest DOCKER-USER rules after every docker (re)start.
+[Service]
+ExecStartPost=/usr/local/sbin/mealquest-firewall
diff --git a/deploy/systemd/mealquest-firewall.service b/deploy/systemd/mealquest-firewall.service
new file mode 100644
index 0000000..fd98254
--- /dev/null
+++ b/deploy/systemd/mealquest-firewall.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Restrict MealQuest port 8090 to Traefik (DOCKER-USER)
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/sbin/mealquest-firewall
+
+[Install]
+WantedBy=multi-user.target
diff --git a/deploy/systemd/mealquest-firewall.sh b/deploy/systemd/mealquest-firewall.sh
new file mode 100755
index 0000000..ca0ff66
--- /dev/null
+++ b/deploy/systemd/mealquest-firewall.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Restrict the MealQuest published host port to Traefik (10.60.1.33) and the
+# Docker host itself (10.60.1.14); drop every other source.
+#
+# DOCKER-USER runs after Docker's DNAT, so the destination port there is the
+# container port (8080), not the published one. Match the original
+# destination port with conntrack instead of --dport.
+#
+# Idempotent: each rule is checked (-C) before it is added, so re-runs add
+# nothing. Installed as /usr/local/sbin/mealquest-firewall.
+set -eu
+
+port=8090
+match="-p tcp -m conntrack --ctorigdstport $port --ctdir ORIGINAL"
+
+iptables -C DOCKER-USER -s 10.60.1.33/32 $match -j RETURN 2>/dev/null ||
+	iptables -I DOCKER-USER 1 -s 10.60.1.33/32 $match -j RETURN
+iptables -C DOCKER-USER -s 10.60.1.14/32 $match -j RETURN 2>/dev/null ||
+	iptables -I DOCKER-USER 2 -s 10.60.1.14/32 $match -j RETURN
+iptables -C DOCKER-USER $match -j DROP 2>/dev/null ||
+	iptables -A DOCKER-USER $match -j DROP