diff --git a/cmd/client/main.go b/cmd/client/main.go
index 48dc8f9..b4e434c 100644
--- a/cmd/client/main.go
+++ b/cmd/client/main.go
@@ -4,6 +4,7 @@ import (
 	"log"
 	"os"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/nixc/reverse-ssh-traefik/internal/buildinfo"
@@ -37,12 +38,22 @@ func main() {
 	authUser := envOr("TUNNEL_AUTH_USER", "")
 	authPass := envOr("TUNNEL_AUTH_PASS", "")
 
-	localHost := envOr("TUNNEL_HOST", "127.0.0.1")
-	localPortStr := envOr("TUNNEL_PORT", "8080")
+	// Backend: trim so compose/YAML stray spaces do not defeat the override (empty → default).
+	rawHost := strings.TrimSpace(os.Getenv("TUNNEL_HOST"))
+	localHost := rawHost
+	if localHost == "" {
+		localHost = "127.0.0.1"
+	}
+	localPortStr := strings.TrimSpace(os.Getenv("TUNNEL_PORT"))
+	if localPortStr == "" {
+		localPortStr = "8080"
+	}
 	localPort, err := strconv.Atoi(localPortStr)
 	if err != nil {
 		log.Fatalf("Invalid TUNNEL_PORT=%q: %v", localPortStr, err)
 	}
+	log.Printf("tunnel-client config: TUNNEL_HOST env raw=%q → backend host %q; TUNNEL_PORT=%q → %d",
+		os.Getenv("TUNNEL_HOST"), localHost, os.Getenv("TUNNEL_PORT"), localPort)
 
 	// Load the private key.
 	signer, err := client.LoadPrivateKey(keyPath)
diff --git a/internal/client/tunnel.go b/internal/client/tunnel.go
index 5fb9efd..20bab4d 100644
--- a/internal/client/tunnel.go
+++ b/internal/client/tunnel.go
@@ -40,7 +40,7 @@ func SetupTunnel(client *ssh.Client, domain string, localHost string, localPort
 	}
 	defer listener.Close()
 
-	log.Printf("Reverse tunnel established: %s -> %s:%d", domain, localHost, localPort)
+	log.Printf("Reverse tunnel established: Host(%s) → backend %s:%d", domain, localHost, localPort)
 
 	// Step 3: Accept connections from the server and forward to local service.
 	for {