diff --git a/.env.example b/.env.example
index 5fc2477..a019ff5 100644
--- a/.env.example
+++ b/.env.example
@@ -24,6 +24,16 @@ WORKSPACE_MAX_UPLOAD_MB=64
 # Set to 1 once the app is served over HTTPS, so the cookie gets `Secure`.
 WORKSPACE_SECURE_COOKIE=0
 
+# --- SFTP mount --------------------------------------------------------------
+# Off until this is set. Once it's up, register a key with `:sshkey add <name>
+# <ssh-ed25519 ...>` in the app, then `sshfs -P <port> anything@host:/ mnt/`
+# (the username is ignored — only the key decides who gets in).
+#
+# Under Docker, bind 0.0.0.0 (not 127.0.0.1) as the app listens inside the
+# container — the host-side address in compose.yml's `ports:` is what
+# actually restricts who can reach it.
+# WORKSPACE_SFTP_BIND=127.0.0.1:2222
+
 # --- Proton Drive backup -----------------------------------------------------
 # Off until `narl-workspace proton-login` stores a session under WORKSPACE_DATA_DIR.
 # These only shape how often the mirror runs.
diff --git a/compose.override.yml.example b/compose.override.yml.example
index fea40da..182a22e 100644
--- a/compose.override.yml.example
+++ b/compose.override.yml.example
@@ -1,7 +1,12 @@
 # Copy to compose.override.yml on the host that runs traefik.
 services:
   workspace:
-    ports: !override []
+    # Traefik only routes HTTP; SFTP (raw TCP) can't go through it, so its
+    # port is published straight to the host instead. Restrict to your IP,
+    # or leave it 127.0.0.1 and reach it over a VPN/SSH tunnel.
+    # Requires WORKSPACE_SFTP_BIND=0.0.0.0:2222 in .env to actually listen.
+    ports: !override
+      - "127.0.0.1:2222:2222"
     networks:
       - narl
       - internal_net
diff --git a/compose.yml b/compose.yml
index a40a2cc..9ae4a91 100644
--- a/compose.yml
+++ b/compose.yml
@@ -20,6 +20,11 @@ services:
       # Localhost only. Drop this in the override when a reverse proxy
       # reaches the container over its own network instead.
       - "127.0.0.1:4242:4242"
+      # Only listens if WORKSPACE_SFTP_BIND is set in .env (see there);
+      # otherwise this maps to a port nothing is bound on. Traefik is
+      # HTTP-only, so a deployment behind it must publish this port itself
+      # rather than relying on the reverse proxy — see compose.override.yml.example.
+      # - "127.0.0.1:2222:2222"
     healthcheck:
       # No extra tooling in the image, so probe the port with bash directly.
       test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/4242"]