diff --git a/capport-example.yaml b/capport-example.yaml
index 27bba9a..b68c715 100644
--- a/capport-example.yaml
+++ b/capport-example.yaml
@@ -9,3 +9,5 @@ venue-info-url: 'https://example.com'
 server-names:
 - localhost
 - ...
+api-port: 8000
+controller-port: 5000
diff --git a/src/capport/api/hypercorn_run.py b/src/capport/api/hypercorn_run.py
index ac1e94c..c9da53c 100644
--- a/src/capport/api/hypercorn_run.py
+++ b/src/capport/api/hypercorn_run.py
@@ -41,6 +41,7 @@ def main() -> None:
     hypercorn_config = hypercorn.config.Config()
     hypercorn_config.application_path = 'capport.api.app'
     hypercorn_config.worker_class = 'trio'
+    hypercorn_config.bind = [f"127.0.0.1:{_config.api_port}"]
 
     if _config.server_names:
         hypercorn_config.server_names = _config.server_names
diff --git a/src/capport/comm/hub.py b/src/capport/comm/hub.py
index 8558771..9a5cbc5 100644
--- a/src/capport/comm/hub.py
+++ b/src/capport/comm/hub.py
@@ -244,7 +244,7 @@ class ControllerConn:
         _logger.info(f"Connecting to controller at {self.hostname}")
         with trio.fail_after(5):
             try:
-                stream = await trio.open_tcp_stream(self.hostname, 5000)
+                stream = await trio.open_tcp_stream(self.hostname, self._hub._config.controller_port)
             except OSError as e:
                 _logger.warning(f"Failed to connect to controller at {self.hostname}: {e}")
                 return
@@ -331,7 +331,7 @@ class Hub:
             _logger.debug(f"Connection from {remote} closed")
 
     async def _listen(self, task_status=trio.TASK_STATUS_IGNORED):
-        await trio.serve_tcp(self._accept, 5000, task_status=task_status)
+        await trio.serve_tcp(self._accept, self._config.controller_port, task_status=task_status)
 
     async def run(self, *, task_status=trio.TASK_STATUS_IGNORED):
         async with trio.open_nursery() as nursery:
diff --git a/src/capport/config.py b/src/capport/config.py
index d897f24..03e2730 100644
--- a/src/capport/config.py
+++ b/src/capport/config.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import dataclasses
+import logging
 import os.path
 import typing
 
@@ -8,6 +9,7 @@ import yaml
 
 
 _cached_config: typing.Optional[Config] = None
+_logger = logging.getLogger(__name__)
 
 
 @dataclasses.dataclass
@@ -19,6 +21,8 @@ class Config:
     cookie_secret: str
     venue_info_url: typing.Optional[str]
     session_timeout: int  # in seconds
+    api_port: int
+    controller_port: int
     debug: bool
 
     @staticmethod
@@ -41,14 +45,21 @@ class Config:
             raise RuntimeError("Missing config file")
         with open(filename) as f:
             data = yaml.safe_load(f)
-        controllers = list(map(str, data['controllers']))
-        return Config(
+        if not isinstance(data, dict):
+            raise RuntimeError(f"Invalid yaml config data, expected dict: {data!r}")
+        controllers = list(map(str, data.pop('controllers')))
+        config = Config(
             _source_filename=filename,
             controllers=controllers,
-            server_names=data.get('server-names', []),
-            comm_secret=str(data.get('comm-secret', None) or data['secret']),
-            cookie_secret=str(data['cookie-secret']),
-            venue_info_url=str(data.get('venue-info-url')),
-            session_timeout=data.get('session-timeout', 3600),
-            debug=data.get('debug', False)
+            server_names=data.pop('server-names', []),
+            comm_secret=str(data.pop('comm-secret')),
+            cookie_secret=str(data.pop('cookie-secret')),
+            venue_info_url=str(data.pop('venue-info-url')),
+            session_timeout=data.pop('session-timeout', 3600),
+            api_port=data.pop('api-port', 8000),
+            controller_port=data.pop('controller-port', 5000),
+            debug=data.pop('debug', False)
         )
+        if data:
+            _logger.error(f"Unknown config elements: {list(data.keys())}")
+        return config