diff --git a/docker/common/nginx/nginx.conf b/docker/common/nginx/nginx.conf
index 73661a583..8ca658a0d 100644
--- a/docker/common/nginx/nginx.conf
+++ b/docker/common/nginx/nginx.conf
@@ -5,8 +5,7 @@ server {
   server_tokens off;
   root /usr/share/nginx/html;
   # SSL stuff for cloudflare proxy-ing - ignores SSL certificate and uses SNI
-
-  add_header Content-Security-Policy "default-src 'self'; script-src 'self' blob: data: 'unsafe-eval' 'unsafe-inline'; script-src-elem 'self' data: blob: 'unsafe-inline'; script-src-attr 'self' data:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:";
+  add_header Content-Security-Policy "frame-ancestors 'none'; connect-src 'self' $API_URL $PDFTRON_ALLOWED_HOSTS; default-src 'self' $API_URL; script-src 'self' blob: data: 'unsafe-eval' 'unsafe-inline'; script-src-elem 'self' data: blob: 'unsafe-inline'; script-src-attr 'self' data:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:";
 
   proxy_ssl_verify off;
   proxy_read_timeout 1m;
@@ -32,4 +31,3 @@ server {
   gzip_types application/javascript text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
 
 }
-
diff --git a/docker/red-ui/docker-entrypoint.sh b/docker/red-ui/40-set-application-config.sh
similarity index 97%
rename from docker/red-ui/docker-entrypoint.sh
rename to docker/red-ui/40-set-application-config.sh
index 91a8f0d4e..50f3530d5 100755
--- a/docker/red-ui/docker-entrypoint.sh
+++ b/docker/red-ui/40-set-application-config.sh
@@ -61,4 +61,7 @@ cat /usr/share/nginx/html/ui/assets/config/config.json
 echo 'Running with config: '
 cat /etc/nginx/nginx.conf
 
-nginx -g 'daemon off;'
+echo 'Default config:'
+cat /etc/nginx/conf.d/default.conf
+
+#nginx -g 'daemon off;'
diff --git a/docker/red-ui/Dockerfile b/docker/red-ui/Dockerfile
index 5e7b99c6b..4dec7a8cc 100644
--- a/docker/red-ui/Dockerfile
+++ b/docker/red-ui/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:20.9-buster as builder
+FROM node:20.11-buster AS builder
 
 WORKDIR /ng-app
 
@@ -24,9 +24,10 @@ CMD ["/bin/cp", "-r", "/ng-app/dist/paligo-styles", "/tmp/styles-export"]
 
 
 FROM nginx:1.25.3-alpine
-
+ENV NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx/conf.d
+ENV PDFTRON_ALLOWED_HOSTS=''
 ## Copy our default nginx config
-COPY docker/common/nginx/nginx.conf /etc/nginx/conf.d/default.conf
+COPY docker/common/nginx/nginx.conf /etc/nginx/templates/default.conf.template
 
 ## Remove default nginx website
 RUN rm -rf /usr/share/nginx/html/*
@@ -40,5 +41,5 @@ RUN chmod g+r -R /usr/share/nginx/html
 ## Change permissions to enable openShift functionality
 # RUN chmod -R g+rwx /var/cache/nginx /var/run /var/log/nginx /usr/share /etc/nginx
 
-COPY docker/red-ui/docker-entrypoint.sh /
-CMD ["/docker-entrypoint.sh"]
+COPY docker/red-ui/40-set-application-config.sh docker-entrypoint.d/
+#CMD ["/docker-entrypoint.sh"]
diff --git a/docker/red-ui/docker-compose.yml b/docker/red-ui/docker-compose.yml
index 6cd662933..0fa829ce5 100644
--- a/docker/red-ui/docker-compose.yml
+++ b/docker/red-ui/docker-compose.yml
@@ -4,4 +4,10 @@ services:
             context: ../../
             dockerfile: ./docker/red-ui/Dockerfile
         ports:
-            - '80:3000'
+            - '4200:8080'
+        environment:
+            PDFTRON_ALLOWED_HOSTS: "https://pws-collect.pdftron.com/"
+            API_URL: "https://dan1.iqser.cloud"
+            OAUTH_URL: "https://dan1.iqser.cloud/auth"
+            OAUTH_CLIENT_ID: "redaction"
+            THEME: "redact"