diff --git a/infrastructure/docker-compose.prod.yaml b/infrastructure/docker-compose.prod.yaml
index 2ebeb86..aad615e 100644
--- a/infrastructure/docker-compose.prod.yaml
+++ b/infrastructure/docker-compose.prod.yaml
@@ -41,6 +41,9 @@ services:
     mem_reservation: 230m
     ports:
       - "127.0.0.1:25434:5432"
+      # wg-only read path for the quinn-data MCP on black (analytics_ro role).
+      # 10.9.0.1 is the vps wireguard address — unreachable from the internet.
+      - "10.9.0.1:25434:5432"
     environment:
       POSTGRES_USER: ${POSTGRES_USER}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}