diff --git a/.gitignore b/.gitignore
index 3c7d4a907..08a6448af 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,6 +92,10 @@ apps/web/.env.local
 docker-data/
 *.tar
 
+# HAProxy SSL certs (never commit private keys)
+docker/haproxy/certs/*.key
+docker/haproxy/certs/*.pem
+
 veza-backend-api/main
 veza-backend-api/api
 veza-backend-api/migrate_tool
@@ -107,6 +111,7 @@ config/incus/env/*.env
 /blob-report/
 /playwright/.cache/
 /playwright/.auth/
+apps/web/e2e/.auth/
 
 *storybook.log
 storybook-static
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index 75d8a2abc..70bcb173f 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -17,7 +17,7 @@ export default defineConfig({
 
   reporter: [['html'], ['json', { outputFile: 'e2e-results.json' }]],
   use: {
-    baseURL: process.env.PLAYWRIGHT_BASE_URL || process.env.VITE_FRONTEND_URL || 'http://localhost:5173',
+    baseURL: process.env.PLAYWRIGHT_BASE_URL || process.env.VITE_FRONTEND_URL || `http://localhost:${process.env.PORT || '5173'}`,
     trace: 'on-first-retry',
     screenshot: 'only-on-failure',
     video: 'retain-on-failure',
@@ -56,10 +56,20 @@ export default defineConfig({
     },
   ],
   webServer: {
-    command: 'npm run dev',
-    url: 'http://localhost:5173',
-    reuseExistingServer: !process.env.CI,
-    timeout: 120 * 1000,
+    command: process.env.PORT ? `PORT=${process.env.PORT} npm run dev` : 'npm run dev',
+    url: `http://localhost:${process.env.PORT || '5173'}`,
+    reuseExistingServer: process.env.CI ? false : true,
+    timeout: 300 * 1000, // 5 min for cold start (CI or slow machines)
+    // CI: ensure Vite proxy targets correct backend (veza.fr:18080)
+    env: process.env.CI
+      ? {
+          ...process.env,
+          PORT: process.env.PORT || '5174',
+          VITE_API_URL: process.env.VITE_API_URL || '/api/v1',
+          VITE_DOMAIN: process.env.VITE_DOMAIN || 'veza.fr',
+          VITE_BACKEND_PORT: process.env.VITE_BACKEND_PORT || '18080',
+        }
+      : undefined,
   },
 });