diff --git a/backend/Properties/launchSettings.json b/backend/Properties/launchSettings.json
index 425bfa2..03b2896 100644
--- a/backend/Properties/launchSettings.json
+++ b/backend/Properties/launchSettings.json
@@ -4,7 +4,7 @@
     "backend": {
       "commandName": "Project",
       "launchBrowser": false,
-      "applicationUrl": "http://localhost:5000",
+      "applicationUrl": "http://localhost:5057",
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }
diff --git a/docs/superpowers/plans/2026-08-15-supabase-todo-app.md b/docs/superpowers/plans/2026-08-15-supabase-todo-app.md
index 6657553..15b632d 100644
--- a/docs/superpowers/plans/2026-08-15-supabase-todo-app.md
+++ b/docs/superpowers/plans/2026-08-15-supabase-todo-app.md
@@ -157,7 +157,7 @@ From the repo root:
 dotnet new webapi --name backend --framework net9.0 --no-https --use-controllers --output backend
 ```
 
-`--no-https` keeps local dev on plain `http://localhost:5000` (matches CORS config in Task 7). `--use-controllers` gives us `Controllers/`-based routing instead of minimal APIs.
+`--no-https` keeps local dev on plain `http://localhost:5057` (matches CORS config in Task 7). `--use-controllers` gives us `Controllers/`-based routing instead of minimal APIs.
 
 Delete the sample files the template generates:
 
@@ -187,7 +187,7 @@ Replace `backend/Properties/launchSettings.json` with:
     "backend": {
       "commandName": "Project",
       "launchBrowser": false,
-      "applicationUrl": "http://localhost:5000",
+      "applicationUrl": "http://localhost:5057",
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }
@@ -264,7 +264,7 @@ cd backend
 dotnet build
 dotnet run &
 sleep 3
-curl -s -o /dev/null -w "%{http_code}\n" http://localhost:5000/openapi/v1.json  # 200 if webapi template's OpenAPI is on
+curl -s -o /dev/null -w "%{http_code}\n" http://localhost:5057/openapi/v1.json  # 200 if webapi template's OpenAPI is on
 kill %1
 ```
 
@@ -685,7 +685,7 @@ sleep 5
 - [ ] **Step 2: Confirm unauthenticated requests are rejected**
 
 ```bash
-curl -s -o /dev/null -w "%{http_code}\n" http://localhost:5000/api/todos
+curl -s -o /dev/null -w "%{http_code}\n" http://localhost:5057/api/todos
 ```
 
 Expected: `401`.
@@ -716,7 +716,7 @@ If `TOKEN` length is under 100 chars, sign-up did NOT return a session — email
 - [ ] **Step 4: GET (empty list)**
 
 ```bash
-curl -s -w "\nHTTP %{http_code}\n" -H "Authorization: Bearer $TOKEN" http://localhost:5000/api/todos
+curl -s -w "\nHTTP %{http_code}\n" -H "Authorization: Bearer $TOKEN" http://localhost:5057/api/todos
 ```
 
 Expected: `[]` then `HTTP 200`.
@@ -724,7 +724,7 @@ Expected: `[]` then `HTTP 200`.
 - [ ] **Step 5: POST (create)**
 
 ```bash
-curl -s -w "\nHTTP %{http_code}\n" -X POST http://localhost:5000/api/todos \
+curl -s -w "\nHTTP %{http_code}\n" -X POST http://localhost:5057/api/todos \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   -d '{"title":"buy milk"}'
 ```
@@ -735,7 +735,7 @@ Expected: a JSON body with `id`, `title:"buy milk"`, `completed:false`, `created
 
 ```bash
 TID=<id from previous step>
-curl -s -w "\nHTTP %{http_code}\n" -X PATCH "http://localhost:5000/api/todos/$TID" \
+curl -s -w "\nHTTP %{http_code}\n" -X PATCH "http://localhost:5057/api/todos/$TID" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   -d '{"completed":true}'
 ```
@@ -745,7 +745,7 @@ Expected: JSON with `completed:true`, `HTTP 200`.
 - [ ] **Step 7: DELETE**
 
 ```bash
-curl -s -w "\nHTTP %{http_code}\n" -X DELETE "http://localhost:5000/api/todos/$TID" \
+curl -s -w "\nHTTP %{http_code}\n" -X DELETE "http://localhost:5057/api/todos/$TID" \
   -H "Authorization: Bearer $TOKEN"
 ```
 
@@ -829,7 +829,7 @@ Create `frontend/.env.example`:
 ```
 VITE_SUPABASE_URL=https://YOURPROJECT.supabase.co
 VITE_SUPABASE_PUBLISHABLE_KEY=sb_publishable_YOURKEY
-VITE_API_URL=http://localhost:5000
+VITE_API_URL=http://localhost:5057
 ```
 
 - [ ] **Step 2: Create `frontend/.env.local` with real values**
@@ -837,7 +837,7 @@ VITE_API_URL=http://localhost:5000
 ```
 VITE_SUPABASE_URL=https://jrbqfctqhjttxobtoqts.supabase.co
 VITE_SUPABASE_PUBLISHABLE_KEY=sb_publishable_QajbbpfedzxWEhCPBKTZqg_M-8qyCUy
-VITE_API_URL=http://localhost:5000
+VITE_API_URL=http://localhost:5057
 ```
 
 - [ ] **Step 3: Create the Supabase client module**
@@ -1351,7 +1351,7 @@ cd backend && dotnet run
 cd frontend && npm run dev
 ```
 
-Expected: backend on `http://localhost:5000`, Vite on `http://localhost:5173`.
+Expected: backend on `http://localhost:5057`, Vite on `http://localhost:5173`.
 
 - [ ] **Step 2: Sign up**
 
@@ -1450,7 +1450,7 @@ Two terminals:
 
 ```bash
 # Terminal 1
-cd backend && dotnet run          # http://localhost:5000
+cd backend && dotnet run          # http://localhost:5057
 
 # Terminal 2
 cd frontend && npm run dev        # http://localhost:5173