diff --git a/backend/WorkClub.Api/Program.cs b/backend/WorkClub.Api/Program.cs
index 2e5b029..4754f71 100644
--- a/backend/WorkClub.Api/Program.cs
+++ b/backend/WorkClub.Api/Program.cs
@@ -52,11 +52,33 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
         options.MapInboundClaims = false;
         options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
-            ValidateIssuer = false,  // Disabled for local dev - external clients use localhost:8080, internal use keycloak:8080
+            ValidateIssuer = false, // Disabled for local dev - external clients use localhost:8080, internal use keycloak:8080
             ValidateAudience = true,
             ValidateLifetime = true,
             ValidateIssuerSigningKey = true
         };
+        options.Events = new JwtBearerEvents
+        {
+            OnAuthenticationFailed = context =>
+            {
+                Console.WriteLine($"JWT Authentication Failed: {context.Exception.Message}");
+                if (context.Exception.InnerException != null)
+                {
+                    Console.WriteLine($"Inner Exception: {context.Exception.InnerException.Message}");
+                }
+                return Task.CompletedTask;
+            },
+            OnTokenValidated = context =>
+            {
+                Console.WriteLine($"JWT Token Validated for user: {context.Principal?.Identity?.Name ?? "unknown"}");
+                return Task.CompletedTask;
+            },
+            OnChallenge = context =>
+            {
+                Console.WriteLine($"JWT Challenge: {context.Error}");
+                return Task.CompletedTask;
+            }
+        };
     });
 
 builder.Services.AddScoped<IClaimsTransformation, ClubRoleClaimsTransformation>();
diff --git a/docker-compose.yml b/docker-compose.yml
index 24311fc..a0f8439 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -70,12 +70,8 @@ services:
     ports:
       - "5001:8080"
     extra_hosts:
-      - "localhost:host-gateway"
-      - "127.0.0.1:host-gateway"
-    networks:
-      app-network:
-        aliases:
-          - keycloak.internal
+      - "localhost:172.18.0.1"
+      - "127.0.0.1:172.18.0.1"
     working_dir: /app
     volumes:
       - ./backend:/app:cached