diff --git a/.env.example b/.env.example
index 893cc1c..eca8956 100644
--- a/.env.example
+++ b/.env.example
@@ -13,6 +13,8 @@ BLACKTIP_TOKEN=
 # Serve http/https with Traefik (path to a Traefik v3 binary), and optionally
 # use DNS challenge for wildcard certificates. The provider's credentials go here
 # too, named exactly as Traefik documents for that provider.
-#BLACKTIP_TRAEFIK=/usr/local/bin/traefik
+# Releases bundle a tested Traefik: /usr/local/lib/blacktip/traefik (systemd install),
+# /traefik (Docker image, already set; set it empty to use the built-in proxy).
+#BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 #BLACKTIP_ACME_DNS=cloudflare
 #CF_DNS_API_TOKEN=
diff --git a/Dockerfile b/Dockerfile
index 2265023..1d5bf3b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,7 +18,9 @@ LABEL org.opencontainers.image.title="Blacktip" \
 COPY --from=prep /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=prep /data /data
 COPY dist/bin/linux_${TARGETARCH}/blacktip /blacktip
-ENV BLACKTIP_DATA=/data
+COPY dist/bin/linux_${TARGETARCH}/traefik /traefik
+# Traefik serves http/https; set BLACKTIP_TRAEFIK= (empty) in .env to use the built-in proxy instead
+ENV BLACKTIP_DATA=/data BLACKTIP_TRAEFIK=/traefik
 VOLUME ["/data"]
 EXPOSE 51820/udp
 ENTRYPOINT ["/blacktip"]
diff --git a/README.md b/README.md
index da56682..808d3e1 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ Open the WireGuard UDP port (default 51820) and any ports you open from the dash
 | `-tunnel` | `BLACKTIP_TUNNEL` | UDP listen address for WireGuard (default `:51820`) |
 | `-data` | `BLACKTIP_DATA` | folder for the WireGuard key and certificates |
 | `-docker` | `BLACKTIP_DOCKER=1` | report local Docker containers so they can be picked as targets |
-| `-traefik` | `BLACKTIP_TRAEFIK` | path to a Traefik v3 binary, to serve http/https with Traefik |
+| `-traefik` | `BLACKTIP_TRAEFIK` | path to a Traefik v3 binary, to serve http/https with Traefik. Release archives and the Docker image include a tested one |
 | `-acme-dns` | `BLACKTIP_ACME_DNS` | with Traefik: DNS-challenge provider for wildcard certificates |
 | `-no-acme` | | with Traefik: serve its self-signed certificate instead of Let's Encrypt |
 | `-env` | | `.env` file to read (default `./.env`) |
diff --git a/deploy/blacktip.service b/deploy/blacktip.service
index 44a8377..99a375b 100644
--- a/deploy/blacktip.service
+++ b/deploy/blacktip.service
@@ -7,6 +7,8 @@ Wants=network-online.target
 [Service]
 User=blacktip
 Group=blacktip
+# The Traefik that ships with Blacktip; set BLACKTIP_TRAEFIK= (empty) in the env file for the built-in proxy.
+Environment=BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 EnvironmentFile=-/etc/blacktip/blacktip.env
 ExecStart=/usr/local/bin/blacktip -data /var/lib/blacktip
 WorkingDirectory=/var/lib/blacktip
diff --git a/deploy/build.sh b/deploy/build.sh
index 6cf322d..1747e3f 100644
--- a/deploy/build.sh
+++ b/deploy/build.sh
@@ -4,7 +4,7 @@
 #   deploy/build.sh [version]      version defaults to `git describe`
 #
 # Output:
-#   dist/bin/<os>_<arch>/blacktip             the raw binaries (the Docker image uses the linux ones)
+#   dist/bin/<os>_<arch>/blacktip and traefik             the raw binaries (the Docker image uses the linux ones)
 #   dist/blacktip_<version>_<os>_<arch>.tar.gz or .zip
 #   dist/SHA256SUMS
 #
@@ -28,10 +28,13 @@ for t in $TARGETS; do
 	CGO_ENABLED=0 GOOS=$os GOARCH=$arch GOARM=7 \
 		go build -trimpath -ldflags "-s -w -X main.version=$VERSION" -o "$out/$NAME$ext" "./cmd/$NAME"
 
+	# the Traefik that Blacktip drives for http/https (see BLACKTIP_TRAEFIK)
+	sh deploy/fetch-traefik.sh "$os" "$arch" "$out"
+
 	pkg="${NAME}_${VERSION}_${os}_${arch}"
 	stage="dist/stage/$pkg"
 	mkdir -p "$stage"
-	cp "$out/$NAME$ext" "$stage/"
+	cp "$out/$NAME$ext" "$out/traefik$ext" "$stage/"
 	for f in LICENSE README.md .env.example; do
 		[ -f "$f" ] && cp "$f" "$stage/"
 	done
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index acb918c..bddba7e 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -15,8 +15,6 @@ services:
       - blacktip-data:/data
       # To list this machine's Docker containers as targets (BLACKTIP_DOCKER=1):
       # - /var/run/docker.sock:/var/run/docker.sock:ro
-      # To serve websites with Traefik (BLACKTIP_TRAEFIK=/traefik): mount a Traefik v3 binary
-      # - /usr/local/bin/traefik:/traefik:ro
 
 volumes:
   blacktip-data:
diff --git a/deploy/fetch-traefik.sh b/deploy/fetch-traefik.sh
new file mode 100644
index 0000000..9521f61
--- /dev/null
+++ b/deploy/fetch-traefik.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+# Downloads the official Traefik release for one platform and checks its checksum.
+#
+#   deploy/fetch-traefik.sh <os> <arch> <destination-dir>
+#
+# Blacktip ships this exact Traefik version, which is the one it was tested with.
+# Set TRAEFIK_VERSION to try another.
+set -eu
+OS=${1:?os} ARCH=${2:?arch} DEST=${3:?destination}
+VERSION=${TRAEFIK_VERSION:-3.7.16}
+case "$ARCH" in arm) ARCH=armv7 ;; esac
+EXT=tar.gz
+[ "$OS" = windows ] && EXT=zip
+BASE="https://github.com/traefik/traefik/releases/download/v$VERSION"
+FILE="traefik_v${VERSION}_${OS}_${ARCH}.$EXT"
+CACHE=${TRAEFIK_CACHE:-${TMPDIR:-/tmp}/traefik-cache}
+mkdir -p "$CACHE" "$DEST"
+[ -f "$CACHE/$FILE" ] || curl -fsSL -o "$CACHE/$FILE" "$BASE/$FILE"
+[ -f "$CACHE/checksums-$VERSION.txt" ] || curl -fsSL -o "$CACHE/checksums-$VERSION.txt" "$BASE/traefik_v${VERSION}_checksums.txt"
+want=$(grep " $FILE\$" "$CACHE/checksums-$VERSION.txt" | cut -d' ' -f1)
+[ -n "$want" ] || { echo "no checksum listed for $FILE" >&2; exit 1; }
+got=$(sha256sum "$CACHE/$FILE" | cut -d' ' -f1)
+[ "$want" = "$got" ] || { echo "checksum mismatch for $FILE" >&2; rm -f "$CACHE/$FILE"; exit 1; }
+if [ "$EXT" = zip ]; then
+	unzip -qo "$CACHE/$FILE" traefik.exe -d "$DEST"
+else
+	tar -xzf "$CACHE/$FILE" -C "$DEST" traefik
+fi
+echo "traefik $VERSION for $OS/$ARCH ready"
diff --git a/deploy/install.sh b/deploy/install.sh
index 1cb340a..8908333 100644
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -30,7 +30,7 @@ if [ "${1:-}" = "--uninstall" ]; then
 	if real; then
 		systemctl disable --now "$NAME" > /dev/null 2>&1 || true
 	fi
-	rm -f "$UNIT" "$BIN"
+	rm -f "$UNIT" "$BIN" "$ROOT/usr/local/lib/$NAME/traefik"
 	if real; then
 		systemctl daemon-reload || true
 	fi
@@ -45,9 +45,13 @@ if real && ! id "$NAME" > /dev/null 2>&1; then
 	say "Created the system user '$NAME'."
 fi
 
-mkdir -p "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
+mkdir -p "$ROOT/usr/local/lib/$NAME" "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
 install -m 0755 "$HERE/$NAME" "$BIN.new"
 mv -f "$BIN.new" "$BIN" # atomic, so upgrading a running service is safe
+if [ -f "$HERE/traefik" ]; then
+	install -m 0755 "$HERE/traefik" "$ROOT/usr/local/lib/$NAME/traefik.new"
+	mv -f "$ROOT/usr/local/lib/$NAME/traefik.new" "$ROOT/usr/local/lib/$NAME/traefik"
+fi
 install -m 0644 "$HERE/$NAME.service" "$UNIT"
 if [ ! -f "$ENVFILE" ]; then
 	install -m 0600 "$HERE/.env.example" "$ENVFILE"