diff --git a/docker-compose/productivity/docker-compose.yml b/docker-compose/productivity/docker-compose.yml
index 679ecb5..b897f63 100644
--- a/docker-compose/productivity/docker-compose.yml
+++ b/docker-compose/productivity/docker-compose.yml
@@ -113,21 +113,20 @@ services:
       - BASE_URL=https://mealie.${DOMAIN}
       - DB_ENGINE=sqlite
     labels:
-      # TRAEFIK & SABLIER CONFIGURATION
-      # ==========================================
+      # TRAEFIK CONFIGURATION
       # Service metadata
+      - "com.centurylinklabs.watchtower.enable=true"
       - "homelab.category=productivity"
       - "homelab.description=Recipe manager and meal planner"
-      # Traefik reverse proxy (comment/uncomment to disable/enable)
-      # If Traefik is on a remote server: these labels are NOT USED; 
-      #   configure external yml files in /traefik/dynamic folder instead.
       - "traefik.enable=true"
+      # Router configuration
       - "traefik.http.routers.mealie.rule=Host(`mealie.${DOMAIN}`)"
       - "traefik.http.routers.mealie.entrypoints=websecure"
       - "traefik.http.routers.mealie.tls.certresolver=letsencrypt"
-      # - "traefik.http.routers.mealie.middlewares=authelia@docker"  # Disabled for family access
+      - "traefik.http.routers.mealie.middlewares=authelia@docker"
+      # Service configuration
       - "traefik.http.services.mealie.loadbalancer.server.port=9000"
-      # Sablier lazy loading (enabled by default - comment out to disable)
+      # Sablier configuration
       - "sablier.enable=true"
       - "sablier.group=${SERVER_HOSTNAME}-mealie"
       - "sablier.start-on-demand=true"
@@ -154,21 +153,20 @@ services:
     depends_on:
       - wordpress-db
     labels:
-      # TRAEFIK & SABLIER CONFIGURATION
-      # ==========================================
+      # TRAEFIK CONFIGURATION
       # Service metadata
+      - "com.centurylinklabs.watchtower.enable=true"
       - "homelab.category=productivity"
       - "homelab.description=Blog and website platform"
-      # Traefik reverse proxy (comment/uncomment to disable/enable)
-      # If Traefik is on a remote server: these labels are NOT USED; 
-      #   configure external yml files in /traefik/dynamic folder instead.
       - "traefik.enable=true"
+      # Router configuration
       - "traefik.http.routers.wordpress.rule=Host(`wordpress.${DOMAIN}`)"
       - "traefik.http.routers.wordpress.entrypoints=websecure"
       - "traefik.http.routers.wordpress.tls.certresolver=letsencrypt"
-      # - "traefik.http.routers.wordpress.middlewares=authelia@docker"  # Disabled for public access
+      - "traefik.http.routers.wordpress.middlewares=authelia@docker"
+      # Service configuration
       - "traefik.http.services.wordpress.loadbalancer.server.port=80"
-      # Sablier lazy loading (enabled by default - comment out to disable)
+      # Sablier configuration
       - "sablier.enable=true"
       - "sablier.group=${SERVER_HOSTNAME}-wordpress"
       - "sablier.start-on-demand=true"
@@ -226,21 +224,20 @@ services:
     depends_on:
       - gitea-db
     labels:
-      # TRAEFIK & SABLIER CONFIGURATION
-      # ==========================================
+      # TRAEFIK CONFIGURATION
       # Service metadata
+      - "com.centurylinklabs.watchtower.enable=true"
       - "homelab.category=productivity"
       - "homelab.description=Self-hosted Git service"
-      # Traefik reverse proxy (comment/uncomment to disable/enable)
-      # If Traefik is on a remote server: these labels are NOT USED; 
-      #   configure external yml files in /traefik/dynamic folder instead.
       - "traefik.enable=true"
+      # Router configuration
       - "traefik.http.routers.gitea.rule=Host(`gitea.${DOMAIN}`)"
       - "traefik.http.routers.gitea.entrypoints=websecure"
       - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
       - "traefik.http.routers.gitea.middlewares=authelia@docker"
+      # Service configuration
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-      # Sablier lazy loading (enabled by default - comment out to disable)
+      # Sablier configuration
       - "sablier.enable=true"
       - "sablier.group=${SERVER_HOSTNAME}-gitea"
       - "sablier.start-on-demand=true"
@@ -280,21 +277,20 @@ services:
       - PGID=${PGID:-1000}
       - TZ=${TZ}
     labels:
-      # TRAEFIK & SABLIER CONFIGURATION
-      # ==========================================
+      # TRAEFIK CONFIGURATION
       # Service metadata
+      - "com.centurylinklabs.watchtower.enable=true"
       - "homelab.category=productivity"
       - "homelab.description=File-based wiki"
-      # Traefik reverse proxy (comment/uncomment to disable/enable)
-      # If Traefik is on a remote server: these labels are NOT USED; 
-      #   configure external yml files in /traefik/dynamic folder instead.
       - "traefik.enable=true"
+      # Router configuration
       - "traefik.http.routers.dokuwiki.rule=Host(`dokuwiki.${DOMAIN}`)"
       - "traefik.http.routers.dokuwiki.entrypoints=websecure"
       - "traefik.http.routers.dokuwiki.tls.certresolver=letsencrypt"
       - "traefik.http.routers.dokuwiki.middlewares=authelia@docker"
+      # Service configuration
       - "traefik.http.services.dokuwiki.loadbalancer.server.port=80"
-      # Sablier lazy loading (enabled by default - comment out to disable)
+      # Sablier configuration
       - "sablier.enable=true"
       - "sablier.group=${SERVER_HOSTNAME}-dokuwiki"
       - "sablier.start-on-demand=true"
@@ -327,21 +323,20 @@ services:
     depends_on:
       - bookstack-db
     labels:
-      # TRAEFIK & SABLIER CONFIGURATION
-      # ==========================================
+      # TRAEFIK CONFIGURATION
       # Service metadata
+      - "com.centurylinklabs.watchtower.enable=true"
       - "homelab.category=productivity"
       - "homelab.description=Documentation and wiki platform"
-      # Traefik reverse proxy (comment/uncomment to disable/enable)
-      # If Traefik is on a remote server: these labels are NOT USED; 
-      #   configure external yml files in /traefik/dynamic folder instead.
       - "traefik.enable=true"
+      # Router configuration
       - "traefik.http.routers.bookstack.rule=Host(`bookstack.${DOMAIN}`)"
       - "traefik.http.routers.bookstack.entrypoints=websecure"
       - "traefik.http.routers.bookstack.tls.certresolver=letsencrypt"
       - "traefik.http.routers.bookstack.middlewares=authelia@docker"
+      # Service configuration
       - "traefik.http.services.bookstack.loadbalancer.server.port=80"
-      # Sablier lazy loading (enabled by default - comment out to disable)
+      # Sablier configuration
       - "sablier.enable=true"
       - "sablier.group=${SERVER_HOSTNAME}-bookstack"
       - "sablier.start-on-demand=true"
@@ -386,21 +381,20 @@ services:
     depends_on:
       - mediawiki-db
     labels:
-      # TRAEFIK & SABLIER CONFIGURATION
-      # ==========================================
+      # TRAEFIK CONFIGURATION
       # Service metadata
+      - "com.centurylinklabs.watchtower.enable=true"
       - "homelab.category=productivity"
       - "homelab.description=MediaWiki platform"
-      # Traefik reverse proxy (comment/uncomment to disable/enable)
-      # If Traefik is on a remote server: these labels are NOT USED; 
-      #   configure external yml files in /traefik/dynamic folder instead.
       - "traefik.enable=true"
+      # Router configuration
       - "traefik.http.routers.mediawiki.rule=Host(`mediawiki.${DOMAIN}`)"
       - "traefik.http.routers.mediawiki.entrypoints=websecure"
       - "traefik.http.routers.mediawiki.tls.certresolver=letsencrypt"
       - "traefik.http.routers.mediawiki.middlewares=authelia@docker"
+      # Service configuration
       - "traefik.http.services.mediawiki.loadbalancer.server.port=80"
-      # Sablier lazy loading (enabled by default - comment out to disable)
+      # Sablier configuration
       - "sablier.enable=true"
       - "sablier.group=${SERVER_HOSTNAME}-mediawiki"
       - "sablier.start-on-demand=true"