diff --git a/containers/vaultwarden/docker-compose.yml b/containers/vaultwarden/docker-compose.yml
index 0b11a1f..f5c97b4 100755
--- a/containers/vaultwarden/docker-compose.yml
+++ b/containers/vaultwarden/docker-compose.yml
@@ -19,7 +19,13 @@ services:
     environment:
       - LOGIN_RATELIMIT_MAX_BURST=10
       - LOGIN_RATELIMIT_SECONDS=60
-      - DOMAIN=https://DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      # APP_URL, not the bare subdomain: vaultwarden VALIDATES this and refuses to
+      # start without a protocol, so on a box with no CFG_DOMAIN_n set the old
+      # https://<subdomain> form resolved to a bare "https://" and the container
+      # exited. APP_URL is already the address this app is reached at in both
+      # worlds — https://vault.<domain> behind Traefik, http://<lan-ip>:<port>
+      # without it — which is exactly what DOMAIN means here.
+      - DOMAIN=APP_URL_DATA #LIBREPORTAL|APP_URL_TAG|APP_URL_DATA
       - ADMIN_TOKEN=VAULTWARDEN_ADMIN_TOKEN_1_DATA #LIBREPORTAL|VAULTWARDEN_ADMIN_TOKEN_1_TAG|VAULTWARDEN_ADMIN_TOKEN_1_DATA
       - SIGNUPS_ALLOWED=VAULTWARDEN_SIGNUPS_ALLOWED_DATA #LIBREPORTAL|VAULTWARDEN_SIGNUPS_ALLOWED_TAG|VAULTWARDEN_SIGNUPS_ALLOWED_DATA
     labels: