diff --git a/docker-compose.yml b/docker-compose.yml
index 95ba7e2..d19cca5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,19 +9,28 @@ services:
       - ./nginx/conf.d:/etc/nginx/conf.d:ro
 
     labels:
-      # ——— Traefik v2 path-based routing ———
-      - traefik.enable=true
+      - "traefik.enable=true"
 
-      # Route: https://b.mindboost.team/media  (optionally with /anything/after/that)
-      - traefik.http.routers.media.rule=Host(`b.mindboost.team`) && Path(`/{path:.*\\.(mp3|aac|m4a|ogg|opus|flac|wav)$}`)
+      #########################################################
+      # 1) ROUTER  ➜  /media/…   (Prefix + Strip)
+      #########################################################
+      - "traefik.http.routers.media-prefix.rule=Host(`b.mindboost.team`) && PathPrefix(`/media`)"
+      - "traefik.http.routers.media-prefix.entrypoints=websecure"
+      - "traefik.http.routers.media-prefix.tls.certresolver=http_resolver"
+      - "traefik.http.routers.media-prefix.middlewares=strip-media"
+      - "traefik.http.middlewares.strip-media.stripPrefix.prefixes=/media"
+      - "traefik.http.routers.media-prefix.service=media"
 
-      # TLS via the proxys “websecure” entrypoint
-      - traefik.http.routers.media.entrypoints=websecure
-      - traefik.http.routers.media.tls.certresolver=http_resolver
-
-      # Upstream container port
-      - traefik.http.services.media.loadbalancer.server.port=80
+      #########################################################
+      # 2) ROUTER  ➜  /noise.wav  /forest.flac  … (Root-Pfad)
+      #########################################################
+      - "traefik.http.routers.media-root.rule=Host(`b.mindboost.team`) && Path(`/{file:.*\\.(mp3|aac|m4a|ogg|opus|flac|wav)$}`)"
+      - "traefik.http.routers.media-root.entrypoints=websecure"
+      - "traefik.http.routers.media-root.tls.certresolver=http_resolver"
+      - "traefik.http.routers.media-root.service=media"
 
+      # Upstream-Port des Containers
+      - "traefik.http.services.media.loadbalancer.server.port=80"
     networks:
       - proxy
 networks: