diff --git a/modules/portainer/module.json b/modules/portainer/module.json
index cb36c93..2bc5c97 100644
--- a/modules/portainer/module.json
+++ b/modules/portainer/module.json
@@ -6,11 +6,17 @@
     "container-runtime"
   ],
   "listens": [
+    {
+      "port": 9090,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the dashboard over http; portainer.novox.be is a route grant and the proxy reaches it here \u2014 the machine side of 9090:9000, the predecessor's number"
+    },
     {
       "port": 9443,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the container dashboard, over its own tls"
+      "why": "the same dashboard over its own tls; the runtime sidecar talks to it here"
     }
   ],
   "resources": [
@@ -23,19 +29,20 @@
     {
       "id": "data",
       "type": "directory",
-      "path": "/services/portainer/data",
+      "path": "/services/portainer/portainer_data",
       "mode": "0700"
     },
     {
       "id": "server",
       "type": "container",
       "name": "portainer",
-      "image": "portainer/portainer-ce@sha256:511f3f06c96fe3b993ebeaafde311c1959cae73a7ef825dba6397d51b450dffa",
+      "image": "portainer/portainer-ce@sha256:4d616db18cfeb5dd41a69c0958bc825c84483ea9cde1106eb82a5d26f3bd8b0e",
       "ports": [
-        "9443"
+        "9090:9000",
+        "9443:9443"
       ],
       "volumes": [
-        "/services/portainer/data:/data",
+        "/services/portainer/portainer_data:/data",
         "/var/run/docker.sock:/var/run/docker.sock"
       ]
     },
@@ -90,5 +97,17 @@
         "from": "Dockerfile"
       }
     ]
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "portainer",
+      "port": 9090
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/portainer/route.json"
   }
 }