diff --git a/docker-compose.override.yml b/docker-compose.override.yml
index d7ed047..2044e97 100644
--- a/docker-compose.override.yml
+++ b/docker-compose.override.yml
@@ -1,4 +1,11 @@
 services:
+  nginx:
+    labels:
+      # Detailed health check protection. /health/live and /health/ready stay
+      # public; only /health/detail discloses internals.
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.rule=Host(`${COMPOSE_DOMAIN:?}`) && PathPrefix(`/health/detail`)"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.middlewares=ITKBasicAuth@file"
+
   # A mock identity provider, so the OpenID Connect login can be exercised locally.
   # The real one has no redirect URI registered for a developer machine.
   #
diff --git a/docker-compose.server.override.yml b/docker-compose.server.override.yml
index 994958e..8671797 100644
--- a/docker-compose.server.override.yml
+++ b/docker-compose.server.override.yml
@@ -1,4 +1,12 @@
 services:
+  nginx:
+    labels:
+      # Detailed health check protection. /health/live and /health/ready stay
+      # public; only /health/detail discloses internals.
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.rule=Host(`${COMPOSE_SERVER_DOMAIN:?}`) && PathPrefix(`/health/detail`)"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.entrypoints=websecure"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.middlewares=ITKBasicAuth@file"
+
   rabbit:
     image: rabbitmq:4-management-alpine
     restart: unless-stopped
diff --git a/docker-compose.server.yml b/docker-compose.server.yml
index 45f2720..4ecac63 100644
--- a/docker-compose.server.yml
+++ b/docker-compose.server.yml
@@ -21,7 +21,7 @@ services:
       - .:/app
 
   nginx:
-    image: nginxinc/nginx-unprivileged:alpine
+    image: nginx/nginx-unprivileged:alpine
     restart: unless-stopped
     networks:
       - app
@@ -50,8 +50,3 @@ services:
       # Cron-metrics protection.
       - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-metrics.rule=Host(`${COMPOSE_SERVER_DOMAIN:?}`) && PathPrefix(`/cron-metrics`) "
       - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-metrics.middlewares=ITKMetricsAuth@file"
-      # Detailed health check protection. /health/live and /health/ready stay
-      # public; only /health/detail discloses internals.
-      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.rule=Host(`${COMPOSE_SERVER_DOMAIN:?}`) && PathPrefix(`/health/detail`)"
-      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.entrypoints=websecure"
-      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.middlewares=ITKBasicAuth@file"
diff --git a/docker-compose.yml b/docker-compose.yml
index 444ce64..e30ba14 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -48,7 +48,7 @@ services:
       - .:/app
 
   nginx:
-    image: nginxinc/nginx-unprivileged:alpine
+    image: nginx/nginx-unprivileged:alpine
     networks:
       - app
       - frontend
@@ -75,10 +75,6 @@ services:
       # Cron-metrics protection.
       - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-metrics.rule=Host(`${COMPOSE_DOMAIN:?}`) && PathPrefix(`/cron-metrics`) "
       - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-metrics.middlewares=ITKMetricsAuth@file"
-      # Detailed health check protection. /health/live and /health/ready stay
-      # public; only /health/detail discloses internals.
-      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.rule=Host(`${COMPOSE_DOMAIN:?}`) && PathPrefix(`/health/detail`)"
-      - "traefik.http.routers.${COMPOSE_PROJECT_NAME:?}-health.middlewares=ITKBasicAuth@file"
 
   mail:
     image: axllent/mailpit
@@ -103,7 +99,7 @@ services:
       - ./:/md
 
   prettier:
-    # Prettier does not (yet, fcf.
+    # Prettier does not (yet, cf.
     # https://github.com/prettier/prettier/issues/15206) have an official
     # docker image.
     # https://hub.docker.com/r/jauderho/prettier is good candidate (cf. https://hub.docker.com/search?q=prettier&sort=updated_at&order=desc)