diff --git a/templates/wger/docker-compose.yml b/templates/wger/docker-compose.yml
index 2bc88c0..e73cd9f 100644
--- a/templates/wger/docker-compose.yml
+++ b/templates/wger/docker-compose.yml
@@ -44,6 +44,14 @@ services:
       # R-738: the image runs `manage.py migrate` at start ONLY with this switch (entrypoint.sh). Without it an update
       # that brings migrations leaves wger serving its front page over an unmigrated database (login 500).
       - DJANGO_PERFORM_MIGRATIONS=True
+      # R-752 (decided by CC unattended 2026-10-01, `09` §3 decision 58 — operator may reverse): django-axes locked by
+      # ip_address, and behind the tunnel every visitor has the tunnel's address (R-753) — a stranger's 10 wrong tries
+      # locked out EVERY household member for 30 min. Now only the targeted name, for 5 min (each try during a lock
+      # restarts it — wger 2.7 hard-codes that — so short is kinder), counted in the database (the default cache
+      # handler warns axes.W001). Measured on 9202: the other member unaffected; the targeted one in again at 7.5 min.
+      - AXES_LOCKOUT_PARAMETERS=username
+      - AXES_COOLOFF_TIME=5
+      - AXES_HANDLER=axes.handlers.database.AxesDatabaseHandler
       - DJANGO_DB_ENGINE=django.db.backends.sqlite3
       - DJANGO_DB_DATABASE=/home/wger/db/database.sqlite
       - DJANGO_DB_USER=wger