diff --git a/docker-compose.yml b/docker-compose.yml
index cf3f479..e9b7279 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,8 +15,19 @@ services:
       DATABASE_URL: /data/parking.sqlite
       # Reach the vision service over the private compose network by service name.
       VISION_URL: http://vision:8089
+      VISION_ENABLED: ${VISION_ENABLED:-1}
       # JWT signing secret MUST be provided at deploy (no insecure default — see auth.ts).
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in the env/.env}
+      # Dedicated ledger-signing key. Falls back to JWT_SECRET (with a warning) if empty;
+      # set a distinct one in prod. See apps/server/.env.example + local-jwt-auth.
+      EVENT_SIGNING_KEY: ${EVENT_SIGNING_KEY:-}
+      # CRITICAL on the plain-HTTP booth LAN: cookies are Secure (HTTPS-only) by DEFAULT,
+      # so without COOKIE_SECURE=0 the auth cookie is never sent over http and operators
+      # CANNOT LOG IN. Leave unset only behind TLS. See disk-os-hardening "deploy-time runbook".
+      COOKIE_SECURE: ${COOKIE_SECURE:-0}
+      # The booth WS live feed checks the browser Origin — must list the address operators
+      # actually hit (e.g. http://<booth-ip>:3000), or the live feed is rejected.
+      WS_ALLOWED_ORIGINS: ${WS_ALLOWED_ORIGINS:-}
     volumes:
       - parking-data:/data
     depends_on: