diff --git a/deploy/vps/docker-compose.override.example.yml b/deploy/vps/docker-compose.override.example.yml
index 9a13908..fbea755 100644
--- a/deploy/vps/docker-compose.override.example.yml
+++ b/deploy/vps/docker-compose.override.example.yml
@@ -11,4 +11,6 @@ services:
     ports:
       - "127.0.0.1:8081:80"
     volumes:
+      # Same target path as the base file's TLS template bind — overrides it,
+      # so only ONE template is rendered (both define `upstream api`).
       - ./deploy/nginx/templates/contract-check-http.conf.template:/etc/nginx/templates/contract-check.conf.template:ro
diff --git a/docker-compose.yml b/docker-compose.yml
index 95a2a67..bc0a2cd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -436,7 +436,9 @@ services:
       - "80:80"
       - "443:443"
     volumes:
-      - ./deploy/nginx/templates:/etc/nginx/templates:ro
+      # Mount exactly ONE template — rendering both would duplicate `upstream api`.
+      # The VPS override (deploy/vps/) swaps in contract-check-http.conf.template here.
+      - ./deploy/nginx/templates/contract-check.conf.template:/etc/nginx/templates/contract-check.conf.template:ro
       - certbot-data:/etc/letsencrypt:ro
       - certbot-webroot:/var/www/certbot:ro
     environment: