diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 30428ba..ac6156e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -161,7 +161,7 @@ jobs:
             type=raw,value=latest
             type=sha,prefix=sha-
           labels: |
-            org.opencontainers.image.title=LanQin Email ${{ matrix.name }}
+            org.opencontainers.image.title=NewSzxcn Email ${{ matrix.name }}
             org.opencontainers.image.version=${{ steps.image.outputs.tag }}
 
       - name: Build and push
@@ -227,7 +227,7 @@ jobs:
           fi
 
           cat > release-notes.md <<EOF
-          # LanQin Email ${tag}
+          # NewSzxcn Email ${tag}
 
           自建邮箱 Webmail 全栈方案，包含 Web、API、Postfix、Dovecot、Rspamd 等组件。
 
@@ -265,7 +265,7 @@ jobs:
         shell: bash
         run: |
           tag="${{ needs.release.outputs.tag }}"
-          title="LanQin Email ${tag}"
+          title="NewSzxcn Email ${tag}"
           if gh release view "${tag}" >/dev/null 2>&1; then
             gh release edit "${tag}" --title "${title}" --notes-file release-notes.md --latest
           else
diff --git a/deploy/.env.example b/deploy/.env.example
index c04f993..d00464d 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -20,6 +20,15 @@ LANQIN_RSPAMD_IMAGE=ghcr.io/zxyszx/newszxcn-email-rspamd:latest
 # 手动部署可执行：openssl rand -hex 24
 LANQIN_UPDATE_TOKEN=
 
+# 可选端口绑定。使用宿主机反向代理时，可将 HTTP 设为 127.0.0.1:8088。
+LANQIN_HTTP_BIND=80
+LANQIN_HTTPS_BIND=443
+LANQIN_SMTP_BIND=25
+LANQIN_SMTPS_BIND=465
+LANQIN_SUBMISSION_BIND=587
+LANQIN_IMAPS_BIND=993
+LANQIN_POP3S_BIND=995
+
 # =========================
 # 对外访问地址
 # =========================
diff --git a/deploy/README.md b/deploy/README.md
index 136d150..b2182c4 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -154,6 +154,14 @@ docker compose -f docker-compose.stack.yml -f docker-compose.stack.build.yml up
 ## 邮件客户端 TLS 证书
 
 Web 站点可以由宿主机 Nginx / 宝塔反代到容器 `80`，但 SMTP/IMAP/POP3 端口不会使用 Web 反代的证书。
+此时可在 `.env` 调整 Web 端口绑定，避免与宿主机 Nginx 的 `80/443` 冲突：
+
+```dotenv
+LANQIN_HTTP_BIND=127.0.0.1:8088
+LANQIN_HTTPS_BIND=127.0.0.1:8443
+```
+
+宿主机 Nginx 再反向代理到 `http://127.0.0.1:8088`。不使用宿主机反向代理时保留默认的 `80` 与 `443` 即可。
 如果第三方客户端连接 `993/995` 时提示证书是 `localhost`，说明 Dovecot 仍在使用容器自带的测试证书。LanQin API 的 SMTP `465/587` submission 不会使用自签测试证书；启用前必须配置可读的真实证书。
 
 生产环境请把域名证书挂载进容器，并在 `.env` 指向证书文件：
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 7632b17..a50937f 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -6,13 +6,13 @@ services:
       LANQIN_UPDATE_SERVICE_URL: http://updater:8080/v1/update
       LANQIN_UPDATE_SERVICE_TOKEN: ${LANQIN_UPDATE_TOKEN:-}
     ports:
-      - "80:80"
-      - "443:443"
-      - "25:25"
-      - "465:465"
-      - "587:587"
-      - "993:993"
-      - "995:995"
+      - "${LANQIN_HTTP_BIND:-80}:80"
+      - "${LANQIN_HTTPS_BIND:-443}:443"
+      - "${LANQIN_SMTP_BIND:-25}:25"
+      - "${LANQIN_SMTPS_BIND:-465}:465"
+      - "${LANQIN_SUBMISSION_BIND:-587}:587"
+      - "${LANQIN_IMAPS_BIND:-993}:993"
+      - "${LANQIN_POP3S_BIND:-995}:995"
     volumes:
       - ./data:/data
       - ./mail:/var/mail/vhosts
diff --git a/install.sh b/install.sh
index 50995d6..848e94b 100755
--- a/install.sh
+++ b/install.sh
@@ -210,7 +210,11 @@ do_update() {
   remember_current_image
   log "正在拉取最新版..."
   compose pull
-  compose up -d --remove-orphans
+  if ! compose up -d --remove-orphans; then
+    warn "新版本容器启动失败，正在自动回滚。"
+    do_rollback
+    fail "更新失败，已回滚到原镜像。"
+  fi
   if ! wait_for_health 90; then
     warn "新版本健康检查失败，正在自动回滚。"
     do_rollback