diff --git a/README.md b/README.md
index 9374e47..41f1ac4 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,8 @@ SESSION_SECRET=a-long-random-secret
 PUBLIC_URL=https://your-domain.example
 ```
 
+If a generated password or secret contains `$`, wrap the value in single quotes in `.env`, for example `SESSION_SECRET='abc$123'`. Docker Compose treats `$` as variable interpolation otherwise.
+
 Start the app:
 
 ```bash
diff --git a/docker-compose.yml b/docker-compose.yml
index 78b0777..6610d77 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,15 +4,15 @@ services:
     ports:
       - "4000:4000"
     environment:
-      NODE_ENV: production
-      PORT: 4000
-      DATABASE_URL: file:/app/backend/data/app.db
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-change-admin-password}
-      STUDENT_PASSWORD: ${STUDENT_PASSWORD:-change-student-password}
-      SESSION_SECRET: ${SESSION_SECRET:-change-this-long-random-secret}
-      PUBLIC_URL: ${PUBLIC_URL:-http://localhost:4000}
-      JUDGE_VIEWPORT_WIDTH: ${JUDGE_VIEWPORT_WIDTH:-800}
-      JUDGE_VIEWPORT_HEIGHT: ${JUDGE_VIEWPORT_HEIGHT:-600}
+      - NODE_ENV=production
+      - PORT=4000
+      - DATABASE_URL=file:/app/backend/data/app.db
+      - ADMIN_PASSWORD
+      - STUDENT_PASSWORD
+      - SESSION_SECRET
+      - PUBLIC_URL
+      - JUDGE_VIEWPORT_WIDTH=800
+      - JUDGE_VIEWPORT_HEIGHT=600
     volumes:
       - frontend_judge_data:/app/backend/data
     restart: unless-stopped