diff --git a/n95-mqtt-bridge/CHANGELOG.md b/n95-mqtt-bridge/CHANGELOG.md
index a3515f1..a82c948 100644
--- a/n95-mqtt-bridge/CHANGELOG.md
+++ b/n95-mqtt-bridge/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.1
+
+- Declare TCP 8007, 8005, 5223, and 8080 in the add-on `ports` map so
+  Home Assistant OS Supervisor opens those ports on the host firewall.
+  Host networking is unchanged; Docker does not remap the ports.
+- Potential operational change: after update, the add-on Network tab
+  lists the four listeners. Rebuild/reinstall so HA picks up 0.1.1.
+
 ## 0.1.0
 
 - First Home Assistant add-on release
diff --git a/n95-mqtt-bridge/DOCS.md b/n95-mqtt-bridge/DOCS.md
index 2aa95af..9c9177c 100644
--- a/n95-mqtt-bridge/DOCS.md
+++ b/n95-mqtt-bridge/DOCS.md
@@ -112,7 +112,10 @@ listener ports must be distinct and in the range 1–65535.
 ## Host networking and ports
 
 The add-on uses host networking because the robot must connect to the exact
-address and ports returned by `/lookup.do`.
+address and ports returned by `/lookup.do`. The same ports are declared in
+`config.yaml` so Supervisor opens them on the Home Assistant OS host
+firewall. Without that map, the process can listen on the host while LAN
+clients (including the robot) time out.
 
 | Port | Purpose | Robot access |
 |---|---|---|
@@ -122,8 +125,11 @@ address and ports returned by `/lookup.do`.
 | `8080/tcp` | Health endpoint | not required |
 
 Changing a robot-facing port changes both the listener and the value advertised
-to the robot. Check that another host service does not already occupy the port.
-Host networking means these ports are not remapped through the Supervisor.
+to the robot. Also change the matching `ports:` entry so Supervisor still
+opens the host firewall for that port. Check that another host service does
+not already occupy the port. Host networking means Docker does not remap
+these ports; the `ports` map is for Supervisor visibility and firewall
+allowance only.
 
 ## MQTT and Home Assistant discovery
 
@@ -200,6 +206,13 @@ a broker service or enter the external broker host.
 Query the exact resolver supplied by DHCP and confirm `lbo.ecouser.net` returns
 `advertise_ip`. Remove cached/secondary public DNS paths, then reboot the robot.
 
+**LAN clients time out on 8007 even though the add-on log shows listeners**
+On Home Assistant OS, Supervisor only opens inbound host ports listed under
+`ports:` in `config.yaml`. Version 0.1.1 declares 8007, 8005, 5223, and 8080.
+Rebuild/update the add-on so that version is installed, then confirm the
+Network tab lists those ports. Loopback on the HAOS box can succeed while
+the robot still times out if the firewall hole is missing.
+
 **The add-on reports an address-already-in-use error**
 Another host service owns one of the four listener ports. Stop that service or
 set a distinct optional port. Reboot the robot after changing advertised ports.
diff --git a/n95-mqtt-bridge/Dockerfile b/n95-mqtt-bridge/Dockerfile
index 93b009a..123cc64 100644
--- a/n95-mqtt-bridge/Dockerfile
+++ b/n95-mqtt-bridge/Dockerfile
@@ -36,7 +36,7 @@ COPY --from=build /out/n95bridge /n95bridge
 COPY rootfs /
 RUN chmod a+x /run.sh
 
-ARG BUILD_VERSION=0.1.0
+ARG BUILD_VERSION=0.1.1
 ARG BUILD_ARCH
 ARG UPSTREAM_REF=v0.1.0
 ARG UPSTREAM_COMMIT=75354b35180f4cc5e92187b6149322b0b94533ba
diff --git a/n95-mqtt-bridge/VERSION b/n95-mqtt-bridge/VERSION
index 6e8bf73..17e51c3 100644
--- a/n95-mqtt-bridge/VERSION
+++ b/n95-mqtt-bridge/VERSION
@@ -1 +1 @@
-0.1.0
+0.1.1
diff --git a/n95-mqtt-bridge/config.yaml b/n95-mqtt-bridge/config.yaml
index 906113c..76e2ca8 100644
--- a/n95-mqtt-bridge/config.yaml
+++ b/n95-mqtt-bridge/config.yaml
@@ -2,13 +2,23 @@ name: "Deebot N95 Local Control"
 description: >-
   Redirect an already-provisioned Deebot N95 to local MQTT discovery and
   control in Home Assistant.
-version: "0.1.0"
+version: "0.1.1"
 slug: "n95_mqtt_bridge"
 url: "https://git.i3omb.com/gronod/ha-gronod-addons/src/branch/main/n95-mqtt-bridge"
 init: false
 startup: application
 boot: auto
 host_network: true
+ports:
+  8007/tcp: 8007
+  8005/tcp: 8005
+  5223/tcp: 5223
+  8080/tcp: 8080
+ports_description:
+  8007/tcp: Robot bootstrap lookup
+  8005/tcp: Firmware check
+  5223/tcp: Robot XMPP
+  8080/tcp: Health
 arch:
   - aarch64
   - amd64