diff --git a/playbooks/deploy-miniflux.yaml b/playbooks/deploy-miniflux.yaml
index 5e73efd..26b025e 100644
--- a/playbooks/deploy-miniflux.yaml
+++ b/playbooks/deploy-miniflux.yaml
@@ -77,6 +77,6 @@ verify:
     shell: docker inspect miniflux-db --format '{{.State.Status}}' | grep -qE 'running|created|restarting'
     changed_when: "false"
 
-  - name: Both containers on miniflux-net
-    shell: docker inspect miniflux miniflux-db --format '{{json .NetworkSettings.Networks}}' | grep -q miniflux-net
+  - name: Both containers on traefik-net
+    shell: docker inspect miniflux miniflux-db --format '{{json .NetworkSettings.Networks}}' | grep -q traefik-net
     changed_when: "false"
diff --git a/stacks/miniflux/compose.yaml b/stacks/miniflux/compose.yaml
index 612c51e..114d28e 100644
--- a/stacks/miniflux/compose.yaml
+++ b/stacks/miniflux/compose.yaml
@@ -42,7 +42,6 @@ services:
       retries: 3
       start_period: 30s
     networks:
-      - miniflux-net
       - tnet
     labels:
       - homepage.group=News
@@ -63,7 +62,7 @@ services:
     volumes:
       - miniflux-db-data:/var/lib/postgresql/data
     networks:
-      - miniflux-net
+      - tnet
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U miniflux"]
       interval: 10s
@@ -74,12 +73,13 @@ volumes:
   miniflux-db-data:
 
 networks:
-  # Internal — only miniflux talks to miniflux-db. DB is not on tnet
-  # so it's not reachable from elsewhere on traefik-net.
-  miniflux-net:
-    name: miniflux-net
-  # Shared external — homepage's docker auto-discovery scans this
-  # network for the homepage.* labels above.
+  # Both containers share traefik-net. Earlier attempt to put the DB
+  # on a private internal network plus miniflux on both nets failed
+  # at create-time with "Container cannot be connected to network
+  # endpoints: miniflux-net, traefik-net" — the docker engine balks
+  # at joining multiple networks (one brand-new, one external) in a
+  # single create step. The DB password still protects miniflux-db,
+  # and traefik-net is internal-LAN-only, so co-locating is fine.
   tnet:
     name: traefik-net
     external: true