diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml
index 9c73110..919bc17 100644
--- a/deploy/docker/docker-compose.yml
+++ b/deploy/docker/docker-compose.yml
@@ -361,19 +361,22 @@ services:
         condition: service_healthy
 
   # ===== Voice Service (LiveKit token + Twilio) =====
+  # NOTE: voice-service stays on bridge networking (single TCP port, no proxy overhead).
+  # Only livekit-server and voice-agent need host mode (UDP port ranges).
   voice-service:
     build:
       context: ../../packages/services/voice-service
     container_name: it0-voice-service
     restart: unless-stopped
-    network_mode: host
+    ports:
+      - "13008:3008"
     volumes:
       - ../../data/voice-models/huggingface:/root/.cache/huggingface
       - ../../data/voice-models/torch-hub:/root/.cache/torch/hub
     environment:
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
       - ANTHROPIC_BASE_URL=${ANTHROPIC_BASE_URL}
-      - AGENT_SERVICE_URL=http://127.0.0.1:13002
+      - AGENT_SERVICE_URL=http://agent-service:3002
       - WHISPER_MODEL=${WHISPER_MODEL:-base}
       - KOKORO_MODEL=${KOKORO_MODEL:-kokoro-82m}
       - KOKORO_VOICE=${KOKORO_VOICE:-zf_xiaoxiao}
@@ -396,6 +399,8 @@ services:
       start_period: 120s
     depends_on:
       - agent-service
+    networks:
+      - it0-network
 
   # ===== Frontend =====
   web-admin: