diff --git a/containers/moneyapp/moneyapp.svg b/containers/moneyapp/moneyapp.svg
new file mode 100644
index 0000000..dc0a61c
--- /dev/null
+++ b/containers/moneyapp/moneyapp.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <circle cx="256" cy="256" r="256" fill="#2e9e6b"/>
+  <rect x="116" y="176" width="280" height="160" rx="20" fill="#ffffff"/>
+  <circle cx="256" cy="256" r="42" fill="none" stroke="#2e9e6b" stroke-width="16"/>
+  <circle cx="168" cy="256" r="11" fill="#2e9e6b"/>
+  <circle cx="344" cy="256" r="11" fill="#2e9e6b"/>
+</svg>
diff --git a/containers/onlyoffice/scripts/onlyoffice_traefik.sh b/containers/onlyoffice/scripts/onlyoffice_traefik.sh
new file mode 100644
index 0000000..b384ed1
--- /dev/null
+++ b/containers/onlyoffice/scripts/onlyoffice_traefik.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# OnlyOffice traefik middleware hooks (consumed by traefikSetupLabelsMiddlewares
+# and tagsProcessorPortMiddlewares). It serves the document editor with its own
+# header requirements, so it opts out of the default chain and adds its own
+# headers middleware.
+
+# Marker — presence means: don't attach default@file to this app's routers.
+appTraefikSkipsDefaultMiddleware_onlyoffice() { :; }
+
+# Extra middleware entries appended for this app.
+appTraefikExtraMiddlewares_onlyoffice() { echo "onlyoffice-headers"; }
diff --git a/containers/owncloud/scripts/owncloud_traefik.sh b/containers/owncloud/scripts/owncloud_traefik.sh
new file mode 100644
index 0000000..64388d3
--- /dev/null
+++ b/containers/owncloud/scripts/owncloud_traefik.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# ownCloud traefik middleware hook. It does its own routing, so it opts out of
+# the default middleware chain (no app-specific extras).
+
+# Marker — presence means: don't attach default@file to this app's routers.
+appTraefikSkipsDefaultMiddleware_owncloud() { :; }
diff --git a/scripts/network/traefik/traefik_middlewares.sh b/scripts/network/traefik/traefik_middlewares.sh
index 43edf18..e8d42a5 100755
--- a/scripts/network/traefik/traefik_middlewares.sh
+++ b/scripts/network/traefik/traefik_middlewares.sh
@@ -5,16 +5,19 @@ traefikSetupLabelsMiddlewares()
     local app_name="$1"
     local middleware_entries=()
 
-    # List of app names to exclude from default middleware
-    local exclude_apps=("onlyoffice" "owncloud")
-    # Check if app_name is not in the list of excluded apps
-    if [[ ! " ${exclude_apps[@]} " =~ " $app_name " ]]; then
+    # Default chain unless the app opts out via its per-app hook
+    # (containers/<app>/scripts/<app>_traefik.sh defines
+    # appTraefikSkipsDefaultMiddleware_<app>).
+    if ! declare -F "appTraefikSkipsDefaultMiddleware_${app_name}" >/dev/null 2>&1; then
         middleware_entries+=("default@file")
     fi
 
-    # App Specific middlewears
-    if [[ "$app_name" == "onlyoffice" ]]; then
-        middleware_entries+=("onlyoffice-headers")
+    # App-specific extras (e.g. onlyoffice-headers) via the per-app hook.
+    if declare -F "appTraefikExtraMiddlewares_${app_name}" >/dev/null 2>&1; then
+        local _mw
+        while IFS= read -r _mw; do
+            [[ -n "$_mw" ]] && middleware_entries+=("$_mw")
+        done < <("appTraefikExtraMiddlewares_${app_name}")
     fi
 
     if [[ "$authelia_setup" == "true" && "$whitelist" == "true" ]]; then
diff --git a/scripts/network/traefik/traefik_port_middlewares.sh b/scripts/network/traefik/traefik_port_middlewares.sh
index 7cbcd23..9c57773 100644
--- a/scripts/network/traefik/traefik_port_middlewares.sh
+++ b/scripts/network/traefik/traefik_port_middlewares.sh
@@ -26,14 +26,12 @@ tagsProcessorPortMiddlewares()
         return 0
     fi
 
-    # Excluded apps that historically opted out of the default middleware
-    # chain — keeps existing behavior for onlyoffice / owncloud which do
-    # their own routing.
-    local exclude_apps=("onlyoffice" "owncloud")
+    # Apps opt out of the default middleware chain via a per-app hook
+    # (containers/<app>/scripts/<app>_traefik.sh defines
+    # appTraefikSkipsDefaultMiddleware_<app>) — e.g. onlyoffice / owncloud, which
+    # do their own routing.
     local include_default="true"
-    if [[ " ${exclude_apps[@]} " =~ " $app_name " ]]; then
-        include_default="false"
-    fi
+    declare -F "appTraefikSkipsDefaultMiddleware_${app_name}" >/dev/null 2>&1 && include_default="false"
 
     local count=${#port_service_names[@]}
     local i=0
@@ -67,9 +65,12 @@ tagsProcessorPortMiddlewares()
                 mw+=("crowdsec-bouncer@file")
             fi
 
-            # onlyoffice / mastodon / similar app-specific middlewares
-            if [[ "$app_name" == "onlyoffice" ]]; then
-                mw+=("onlyoffice-headers")
+            # App-specific extras (e.g. onlyoffice-headers) via the per-app hook.
+            if declare -F "appTraefikExtraMiddlewares_${app_name}" >/dev/null 2>&1; then
+                local _mw
+                while IFS= read -r _mw; do
+                    [[ -n "$_mw" ]] && mw+=("$_mw")
+                done < <("appTraefikExtraMiddlewares_${app_name}")
             fi
 
             local joined; joined=$(IFS=,; echo "${mw[*]}")