diff --git a/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml b/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml
index 282fc2e..0a4a080 100644
--- a/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml
+++ b/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml
@@ -27,13 +27,16 @@
               container_name: vaultwarden
               restart: unless-stopped
               ports:
-                - "{{ vaultwarden_port }}:80"
+                # Loopback only. Docker writes its own iptables rules AHEAD of
+                # UFW, so a bare "8222:80" was reachable from the internet as
+                # plain HTTP, bypassing Caddy and TLS. Caddy is the only client.
+                - "127.0.0.1:{{ vaultwarden_port }}:80"
               volumes:
                 - ./data:/data
               environment:
                 WEBSOCKET_ENABLED: 'true'
                 DOMAIN: "https://{{ vaultwarden_domain }}"
-                SIGNUPS_ALLOWED: 'true'
+                SIGNUPS_ALLOWED: '{{ vaultwarden_signups_allowed | bool | lower }}'
                 LOG_FILE: /data/vaultwarden.log
 
     - name: Deploy vaultwarden container with docker compose
diff --git a/ansible/services/vaultwarden/vaultwarden_vars.yml b/ansible/services/vaultwarden/vaultwarden_vars.yml
index 9edc2cd..c7470f5 100644
--- a/ansible/services/vaultwarden/vaultwarden_vars.yml
+++ b/ansible/services/vaultwarden/vaultwarden_vars.yml
@@ -3,6 +3,13 @@ vaultwarden_dir: /opt/vaultwarden
 vaultwarden_data_dir: "{{ vaultwarden_dir }}/data"
 vaultwarden_port: 8222
 
+# Public registration. OFF: the accounts exist, and this vault is on the open
+# internet. It used to be hardcoded 'true' in the compose file and turned off by
+# a separate manual playbook - so every routine run of the deploy (site.yml
+# included) silently re-opened sign-ups. Flip to true only to add an account,
+# then back.
+vaultwarden_signups_allowed: false
+
 # (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)
 
 # Remote access