diff --git a/base.yml b/base.yml
index a1ae596a..b1e62480 100644
--- a/base.yml
+++ b/base.yml
@@ -1,4 +1,11 @@
 networks:
+  # Second network Traefik also listens on, so a service can be routed WITHOUT
+  # sitting on `chains` next to the RPC nodes, Redis and the Traefik API (a
+  # public-facing site next to unauthenticated :8545 endpoints is a foothold we
+  # do not want to hand out). Overridable per host via TRAEFIK_EXTRA_NETWORK;
+  # the default is an empty bridge, so hosts that do not use it are unaffected.
+  extra:
+    name: ${TRAEFIK_EXTRA_NETWORK:-rpc_extra}
   chains:
     driver: bridge
     ipam:
diff --git a/rpc.yml b/rpc.yml
index a9e62a19..195cf95d 100644
--- a/rpc.yml
+++ b/rpc.yml
@@ -38,6 +38,7 @@ services:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
     networks:
       - chains
+      - extra
     labels:
       - "traefik.enable=true"
       - "traefik.http.middlewares.ipallowlist.ipallowlist.sourcerange=$WHITELIST"