diff --git a/compose.yaml b/compose.yaml
index 90c38ea652d7b7e1284d3ca61a364d2e2ee603a2..4708f81903eeb04d71a791c11ece705568bb24e8 100755
--- a/compose.yaml
+++ b/compose.yaml
@@ -7,6 +7,12 @@ services:
       - 80:80
       - 443:443
     restart: unless-stopped
+    networks:
+      default:
+        aliases:
+          # lets containers reach keycloak through caddy at its public name
+          # without the stale-/etc/hosts-entry trick (the ip changes on recreate)
+          - "auth.${HOME_DOMAIN}"
     user: "$USER_ID:$GROUP_ID"
     volumes:
       - "./config:/etc/caddy:ro"
diff --git a/config/forgejo/init/entry.sh b/config/forgejo/init/entry.sh
index cde6fac7be682581928de11357e6d31a9d035931..bc443418425c035f8747ed33644429d0806444b3 100644
--- a/config/forgejo/init/entry.sh
+++ b/config/forgejo/init/entry.sh
@@ -5,8 +5,6 @@ mkdir -p /custom/conf
 envsubst </custom/init/app.ini >/custom/conf/app.ini
 chmod 444 /custom/conf/app.ini
 
-CADDY_IP="$(getent hosts caddy | awk '{print $1}')"
-echo "${CADDY_IP} auth.${HOME_DOMAIN}" >>/etc/hosts
 
 /usr/bin/entrypoint echo meow >/dev/null
 su git -c "bash /custom/init/config.sh"
diff --git a/config/keycloak/forward-auth/entry.sh b/config/keycloak/forward-auth/entry.sh
index d8b5dca1fbc277f23f2f4c02cad16cece8ffe661..ba558ceea0fb9f86fec99779a245b22ba66a39de 100755
--- a/config/keycloak/forward-auth/entry.sh
+++ b/config/keycloak/forward-auth/entry.sh
@@ -1,8 +1,6 @@
 #!/bin/sh
 set -e
 
-CADDY_IP="$(nslookup caddy | awk '/^Address: / { print $2 }')"
-echo "${CADDY_IP} auth.${HOME_DOMAIN}" >>/etc/hosts
 rm -f /etc/ssl/certs/caddy.crt
 ln -s /caddy/pki/authorities/root.crt /etc/ssl/certs/caddy.crt