diff --git a/docker-compose.yml b/docker-compose.yml
index 20e1aa0..3668405 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,9 @@ services:
     build: .
     image: camptickets:latest
     container_name: camptickets
-    env_file: .env
+    # Single source of truth for secrets — edit backend/.env, then
+    # `docker compose up -d`. (Was ./.env; consolidated to avoid a stale copy.)
+    env_file: backend/.env
     environment:
       # Container always listens on 8080 internally; the host mapping below is
       # what nginx proxies to. Keep this fixed regardless of .env PORT.