diff --git a/docker-compose.yml b/docker-compose.yml
index 7f168d6..8b19430 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -26,14 +26,15 @@ services:
     mysql:
         image: 'mysql/mysql-server:8.0'
         ports:
-            - '${FORWARD_DB_PORT:-3306}:3306'
+            # Bound to the loopback interface: reachable from this machine and
+            # from the compose network, not from the rest of the LAN.
+            - '127.0.0.1:${FORWARD_DB_PORT:-3306}:3306'
         environment:
             MYSQL_ROOT_PASSWORD: '${DB_PASSWORD}'
             MYSQL_ROOT_HOST: '%'
             MYSQL_DATABASE: '${DB_DATABASE}'
             MYSQL_USER: '${DB_USERNAME}'
             MYSQL_PASSWORD: '${DB_PASSWORD}'
-            MYSQL_ALLOW_EMPTY_PASSWORD: 1
             MYSQL_EXTRA_OPTIONS: '${MYSQL_EXTRA_OPTIONS}'
         volumes:
             - 'sail-mysql:/var/lib/mysql'
@@ -50,9 +51,13 @@ services:
             timeout: 5s
     phpmyadmin:
         image: phpmyadmin
-        restart: always
+        # Opt-in: `docker compose --profile tools up`. Keeps a database admin UI
+        # from starting automatically on every `up`.
+        profiles:
+            - tools
+        restart: unless-stopped
         ports:
-            - "3333:80"
+            - "127.0.0.1:3333:80"
         networks:
             - sail
         depends_on: