diff --git a/README.md b/README.md
index e50adc6..f7924c1 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,8 @@ Forgery reads the following environment variables:
 - `STORAGE_BACKEND`: either `local` (default) or `s3`. Chose `local` to store
   the application state to local files, or `s3` to store them in S3-compatible
   storage (see below for corresponding configuration variables).
+- `LISTEN_ADDR`: address on which the webserver listens (default: `0.0.0.0`)
+- `LISTEN_PORT`: port on which the webserver listens (default: `8080`)
 
 Environment variables read when `ACTUALLY_BAN_USERS=true`:
 - `SMTP_ADDRESS`: address of the SMTP relay used to send email notifications
@@ -57,5 +59,4 @@ Environment variables read when `STORAGE_BACKEND=s3`:
    could not be locked, but delete the account after the grace period even if
    the email could not be sent…)
 - auth: add support for connecting to the forge using oauth?
-- allow customizing the address & port on which to listen 
 - improve error handling 
diff --git a/src/main.rs b/src/main.rs
index 7a3b578..ef3b814 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -57,6 +57,8 @@ pub struct Config {
     pub org_name: String,
     pub admin_contact_email: String,
     pub actually_ban: ActuallyBan,
+    pub listen_addr: String,
+    pub listen_port: u16,
 }
 
 impl Config {
@@ -81,11 +83,21 @@ impl Config {
             Err(_) => ActuallyBan::No,
         };
 
+        let listen_addr = std::env::var("LISTEN_ADDR").unwrap_or(String::from("0.0.0.0"));
+        let listen_port: u16 =
+            match std::env::var("LISTEN_PORT").map(|s| u16::from_str_radix(&s, 10)) {
+                Ok(Err(e)) => return Err(anyhow!("LISTEN_PORT: invalid value ({})", e)),
+                Ok(Ok(p)) => p,
+                Err(_) => 8080,
+            };
+
         Ok(Config {
             forge_url: Url::parse(&forge_url_s).context("parsing FORGEJO_URL")?,
             org_name,
             admin_contact_email,
             actually_ban,
+            listen_addr,
+            listen_port,
         })
     }
 }
@@ -479,7 +491,10 @@ async fn main() -> anyhow::Result<()> {
             .spawn(async move { workers::lock_and_notify_users(config, storage, forge, db).await })
     };
 
-    println!("Listening on http://127.0.0.1:8080");
+    println!(
+        "Listening on http://{}:{}",
+        config.listen_addr, config.listen_port
+    );
 
     let app = Router::new()
         .route("/", get(get_index).post(post_classified_index))
@@ -488,7 +503,10 @@ async fn main() -> anyhow::Result<()> {
         .with_state(shared_state);
 
     let webserver = {
-        let listener = tokio::net::TcpListener::bind("0.0.0.0:8080").await.unwrap();
+        let listener =
+            tokio::net::TcpListener::bind((config.listen_addr.clone(), config.listen_port))
+                .await
+                .unwrap();
         axum::serve(listener, app)
     };