diff --git a/dynamicweb/settings/base.py b/dynamicweb/settings/base.py
index 58de437f..d3437084 100644
--- a/dynamicweb/settings/base.py
+++ b/dynamicweb/settings/base.py
@@ -172,6 +172,7 @@ INSTALLED_APPS = (
 )
 
 MIDDLEWARE = (
+    'whitenoise.middleware.WhiteNoiseMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'utils.middleware.MultipleProxyMiddleware',
     'django.middleware.common.CommonMiddleware',
@@ -441,6 +442,9 @@ TEXT_SAVE_IMAGE_FUNCTION = (
 TEXT_ADDITIONAL_TAGS = ('iframe',)
 TEXT_ADDITIONAL_ATTRIBUTES = ('scrolling', 'allowfullscreen', 'frameborder')
 USE_X_FORWARDED_HOST = True
+# Behind a TLS-terminating proxy/ingress that sets X-Forwarded-Proto
+if bool_env('BEHIND_TLS_PROXY'):
+    SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
 
 # Django Bootstrap - Settings
 # Added Configuration for bootstrap static files to load over https.
diff --git a/requirements.txt b/requirements.txt
index 6e40dda3..77613568 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -75,6 +75,7 @@ djangocms-video==3.1.0
 djangorestframework==3.18.1
 easy-thumbnails==2.10.1
 flake8==7.4.1
+gunicorn==23.0.0
 html5lib==1.1
 idna==3.20
 kombu==5.6.2
@@ -124,6 +125,7 @@ vine==5.1.0
 wcwidth==0.9.2
 webencodings==0.6.1
 wheel==0.48.0
+whitenoise==6.9.0
 wrapt==2.5.0
 yurl==1.0.0
 git+https://github.com/ungleich/python-oca.git#egg=oca
diff --git a/start-web.sh b/start-web.sh
index 03404cce..da036fa9 100644
--- a/start-web.sh
+++ b/start-web.sh
@@ -1,10 +1,13 @@
 #!/bin/sh
 # Container start-up for the web service: migrate, make sure every configured
-# site exists in the DB, then serve.
+# site exists in the DB, then serve with gunicorn.
+# RUN_MIGRATIONS=False skips the migrations (when a separate job runs them);
+# MIGRATE_ONLY=True exits after them.
 set -ue
 cd /usr/src/app
 export DJANGO_SETTINGS_MODULE=dynamicweb.settings
 
+if [ "${RUN_MIGRATIONS:-True}" = "True" ]; then
 python - <<'PYEOF'
 import json, os
 import django
@@ -45,9 +48,19 @@ from django.contrib.sites.models import Site
 for domain in json.loads(os.environ.get('UNGLEICH_SITE_CONFIGS') or '{}'):
     Site.objects.get_or_create(domain=domain, defaults={'name': domain})
 PYEOF
+fi
+
+if [ "${MIGRATE_ONLY:-False}" = "True" ]; then
+    exit 0
+fi
 
 if [ "${SEED_DUMMY_DATA:-False}" = "True" ]; then
     python manage.py seed_dummy_data || echo 'seed_dummy_data failed, continuing'
 fi
 
-exec python manage.py runserver 0.0.0.0:8000
+# Served by WhiteNoise
+python manage.py collectstatic --noinput -v0
+
+exec gunicorn dynamicweb.wsgi:application --bind 0.0.0.0:8000 \
+    --workers "${GUNICORN_WORKERS:-3}" --timeout "${GUNICORN_TIMEOUT:-120}" \
+    --access-logfile - --error-logfile -