diff --git a/compose/services/backrest/compose.yaml b/compose/services/backrest/compose.yaml
index 864f823..310897f 100644
--- a/compose/services/backrest/compose.yaml
+++ b/compose/services/backrest/compose.yaml
@@ -26,8 +26,8 @@ services:
       traefik.http.routers.backrest.tls.certresolver: letsencrypt
       traefik.http.services.backrest.loadbalancer.server.port: 9898
 
-      # Require authentication
-      traefik.http.routers.backrest.middlewares: tinyauth
+      # Require authentication and restrict to local network
+      traefik.http.routers.backrest.middlewares: tinyauth,local-only
 
       # Homarr Discovery
       homarr.name: Backrest Backup
diff --git a/compose/services/code-server/compose.yaml b/compose/services/code-server/compose.yaml
index a75de26..c6ef337 100644
--- a/compose/services/code-server/compose.yaml
+++ b/compose/services/code-server/compose.yaml
@@ -29,8 +29,8 @@ services:
       traefik.http.routers.code-server.tls.certresolver: letsencrypt
       traefik.http.services.code-server.loadbalancer.server.port: 8443
 
-      # SSO Protection
-      traefik.http.routers.code-server.middlewares: tinyauth
+      # SSO Protection and restrict to local network
+      traefik.http.routers.code-server.middlewares: tinyauth,local-only
 
       # Homarr Discovery
       homarr.name: Code Server (IDE)
diff --git a/compose/services/ollama/compose.yaml b/compose/services/ollama/compose.yaml
index f6b32db..5fbc7fe 100644
--- a/compose/services/ollama/compose.yaml
+++ b/compose/services/ollama/compose.yaml
@@ -43,8 +43,8 @@ services:
       traefik.http.routers.ollama.tls.certresolver: letsencrypt
       traefik.http.services.ollama.loadbalancer.server.port: 11434
 
-      # SSO Protection for API
-      traefik.http.routers.ollama.middlewares: tinyauth
+      # SSO Protection for API and restrict to local network
+      traefik.http.routers.ollama.middlewares: tinyauth,local-only
 
       # Homarr Discovery
       homarr.name: Ollama (LLM)