diff --git a/docker-compose.yml b/docker-compose.yml
index ae53edb..05cc453 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -36,6 +36,8 @@ services:
       - storage
     restart: "no"
 
+  # Kept only as the way back until Garage has proven itself: not routed,
+  # not bootstrapped, its data frozen as of the switch.
   minio:
     image: minio/minio:latest
     container_name: storage-minio
@@ -49,25 +51,14 @@ services:
       - minio_data:/data
     networks:
       - storage
-      - traefik
     healthcheck:
       test: ["CMD", "mc", "ready", "local"]
       interval: 5s
       timeout: 5s
       retries: 10
     labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=traefik"
-      - "traefik.http.routers.minio-s3.rule=Host(`s3.asxp.io`)"
-      - "traefik.http.routers.minio-s3.entrypoints=websecure"
-      - "traefik.http.routers.minio-s3.tls=true"
-      - "traefik.http.routers.minio-s3.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.minio-s3.service=minio-s3"
-      - "traefik.http.services.minio-s3.loadbalancer.server.port=9000"
+      - "traefik.enable=false"
 
-  # Replaces MinIO (abandoned upstream; its images are gone from the
-  # registries). Not routed yet: MinIO still answers s3.asxp.io until the data
-  # is copied and the apps are switched.
   garage:
     image: dxflrs/garage:v2.5.0
     container_name: storage-garage
@@ -87,7 +78,28 @@ services:
       timeout: 5s
       retries: 10
     labels:
-      - "traefik.enable=false"
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik"
+      # The S3 API.
+      - "traefik.http.routers.garage-s3.rule=Host(`s3.asxp.io`)"
+      - "traefik.http.routers.garage-s3.entrypoints=websecure"
+      - "traefik.http.routers.garage-s3.tls=true"
+      - "traefik.http.routers.garage-s3.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.garage-s3.service=garage-s3"
+      - "traefik.http.services.garage-s3.loadbalancer.server.port=3900"
+      # Anonymous reads of the public bucket: unsigned GET/HEAD of
+      # /public/<key> goes to the web endpoint as Host public.web.garage,
+      # path /<key>. Signed requests still reach the S3 API above.
+      - "traefik.http.routers.garage-public.rule=Host(`s3.asxp.io`) && PathPrefix(`/public/`) && (Method(`GET`) || Method(`HEAD`)) && !HeaderRegexp(`Authorization`, `.+`) && !QueryRegexp(`X-Amz-Signature`, `.+`)"
+      - "traefik.http.routers.garage-public.priority=1000"
+      - "traefik.http.routers.garage-public.entrypoints=websecure"
+      - "traefik.http.routers.garage-public.tls=true"
+      - "traefik.http.routers.garage-public.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.garage-public.service=garage-web"
+      - "traefik.http.routers.garage-public.middlewares=garage-public-strip,garage-public-host"
+      - "traefik.http.middlewares.garage-public-strip.stripprefix.prefixes=/public"
+      - "traefik.http.middlewares.garage-public-host.headers.customrequestheaders.Host=public.web.garage"
+      - "traefik.http.services.garage-web.loadbalancer.server.port=3902"
 
 volumes:
   pg_data: