diff --git a/docker-compose.yml b/docker-compose.yml
index 2fdb6b4..bf33fa0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,6 +4,7 @@ services:
     container_name: basil-postgres
     restart: unless-stopped
     environment:
+      TZ: America/Denver
       POSTGRES_USER: basil
       POSTGRES_PASSWORD: basil
       POSTGRES_DB: basil
@@ -51,6 +52,7 @@ services:
       APP_URL: ${APP_URL:-https://basil.pkartchner.com}
       API_URL: ${API_URL:-https://basil.pkartchner.com}
     volumes:
+      - /etc/localtime:/etc/localtime:ro   # image has no zoneinfo; TZ= would fall back to UTC
       - uploads_data:/app/uploads
       - backups_data:/app/backups
     networks:
@@ -64,6 +66,8 @@ services:
       dockerfile: packages/web/Dockerfile
     container_name: basil-web
     restart: unless-stopped
+    environment:
+      TZ: America/Denver
     depends_on:
       - api
     networks:
@@ -79,7 +83,7 @@ services:
       - "traefik.http.routers.basil.rule=Host(`basil.pkartchner.com`)"
       - "traefik.http.routers.basil.entrypoints=https"
       - "traefik.http.routers.basil.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.basil.middlewares=geoblock@file,secure-headers@file,crowdsec-bouncer@file"
+      - "traefik.http.routers.basil.middlewares=geoblock@file,secure-headers@file,crowdsec-bouncer@docker"
       # Service
       - "traefik.http.services.basil.loadbalancer.server.port=80"
       - "traefik.docker.network=traefik"