diff --git a/internal/net/http/middleware/middleware.go b/internal/net/http/middleware/middleware.go
index d20072e..78410d3 100644
--- a/internal/net/http/middleware/middleware.go
+++ b/internal/net/http/middleware/middleware.go
@@ -94,9 +94,9 @@ func (m *Middleware) finalize() {
 }
 
 func (m *Middleware) New(optsRaw OptionsRaw) (*Middleware, E.Error) {
-	if m.construct == nil {
-		if optsRaw != nil {
-			panic("bug: middleware already constructed")
+	if m.construct == nil { // likely a middleware from compose
+		if len(optsRaw) != 0 {
+			return nil, E.New("additional options not allowed for middleware ").Subject(m.name)
 		}
 		return m, nil
 	}
diff --git a/internal/net/http/middleware/middlewares.go b/internal/net/http/middleware/middlewares.go
index 74ccb45..cfea2c3 100644
--- a/internal/net/http/middleware/middlewares.go
+++ b/internal/net/http/middleware/middlewares.go
@@ -61,17 +61,38 @@ func LoadComposeFiles() {
 		logger.Err(err).Msg("failed to list middleware definitions")
 		return
 	}
+	for _, defFile := range middlewareDefs {
+		voidErrs := E.NewBuilder("") // ignore these errors, will be added in next step
+		mws := BuildMiddlewaresFromComposeFile(defFile, voidErrs)
+		if len(mws) == 0 {
+			continue
+		}
+		for name, m := range mws {
+			name = strutils.ToLowerNoSnake(name)
+			if _, ok := allMiddlewares[name]; ok {
+				errs.Add(ErrDuplicatedMiddleware.Subject(name))
+				continue
+			}
+			allMiddlewares[name] = m
+			logger.Info().
+				Str("src", path.Base(defFile)).
+				Str("name", name).
+				Msg("middleware loaded")
+		}
+	}
+	// build again to resolve cross references
 	for _, defFile := range middlewareDefs {
 		mws := BuildMiddlewaresFromComposeFile(defFile, errs)
 		if len(mws) == 0 {
 			continue
 		}
 		for name, m := range mws {
+			name = strutils.ToLowerNoSnake(name)
 			if _, ok := allMiddlewares[name]; ok {
-				errs.Add(ErrDuplicatedMiddleware.Subject(name))
+				// already loaded above
 				continue
 			}
-			allMiddlewares[strutils.ToLowerNoSnake(name)] = m
+			allMiddlewares[name] = m
 			logger.Info().
 				Str("src", path.Base(defFile)).
 				Str("name", name).
diff --git a/next-release.md b/next-release.md
index a40874c..bf902e9 100644
--- a/next-release.md
+++ b/next-release.md
@@ -98,15 +98,20 @@ GoDoxy v0.8.2 expected changes
 ````
 
 - config reload will now cause all servers to fully restart (i.e. proxy, api, prometheus, etc)
-
 - multiline-string as list now treated as YAML list, which requires hyphen prefix `-`, i.e.
   ```yaml
   proxy.app.middlewares.request.hide_headers:
     - X-Header1
     - X-Header2
 ````
-
 - autocert now supports hot-reload
+- middleware compose now supports cross-referencing, e.g.
+  ```yaml
+  foo:
+    - use: RedirectHTTP
+  bar: # in the same file or different file
+    - use: foo@file
+  ```
 
 - Fixes
   - bug: cert renewal failure no longer causes renew schdueler to stuck forever