diff --git a/deploy/.env.example b/deploy/.env.example
index 44821064..26bb99b5 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -58,6 +58,8 @@ TZ=Asia/Shanghai
 POSTGRES_USER=sub2api
 POSTGRES_PASSWORD=change_this_secure_password
 POSTGRES_DB=sub2api
+# PostgreSQL 监听端口（同时用于 PG 服务端和应用连接，默认 5432）
+DATABASE_PORT=5432
 
 # -----------------------------------------------------------------------------
 # PostgreSQL 服务端参数（可选；主要用于 deploy/docker-compose-aicodex.yml）
@@ -106,6 +108,8 @@ DATABASE_CONN_MAX_IDLE_TIME_MINUTES=5
 # -----------------------------------------------------------------------------
 # Redis Configuration
 # -----------------------------------------------------------------------------
+# Redis 监听端口（同时用于应用连接和 Redis 服务端，默认 6379）
+REDIS_PORT=6379
 # Leave empty for no password (default for local development)
 REDIS_PASSWORD=
 REDIS_DB=0
diff --git a/deploy/docker-compose-aicodex.yml b/deploy/docker-compose-aicodex.yml
index 44ff6ddd..f650a60e 100644
--- a/deploy/docker-compose-aicodex.yml
+++ b/deploy/docker-compose-aicodex.yml
@@ -165,6 +165,9 @@ services:
       - "postgres"
       - "-c"
       - "listen_addresses=127.0.0.1"
+      # 监听端口：与应用侧 DATABASE_PORT 保持一致。
+      - "-c"
+      - "port=${DATABASE_PORT:-5432}"
       # 连接数上限：需要结合应用侧 DATABASE_MAX_OPEN_CONNS 调整。
       # 注意：max_connections 过大可能导致内存占用与上下文切换开销显著上升。
       - "-c"
@@ -177,7 +180,7 @@ services:
       - "-c"
       - "maintenance_work_mem=${POSTGRES_MAINTENANCE_WORK_MEM:-128MB}"
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-sub2api} -d ${POSTGRES_DB:-sub2api}"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-sub2api} -d ${POSTGRES_DB:-sub2api} -p ${DATABASE_PORT:-5432}"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -201,6 +204,7 @@ services:
     command: >
       redis-server
       --bind 127.0.0.1
+      --port ${REDIS_PORT:-6379}
       --maxclients ${REDIS_MAXCLIENTS:-50000}
       --save 60 1
       --appendonly yes
@@ -211,7 +215,7 @@ services:
       # REDISCLI_AUTH is used by redis-cli for authentication (safer than -a flag)
       - REDISCLI_AUTH=${REDIS_PASSWORD:-}
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: ["CMD-SHELL", "redis-cli -p ${REDIS_PORT:-6379} -a \"$REDISCLI_AUTH\" ping | grep -q PONG || redis-cli -p ${REDIS_PORT:-6379} ping | grep -q PONG"]
       interval: 10s
       timeout: 5s
       retries: 5