diff --git a/README.md b/README.md
index 26168ac..0860510 100644
--- a/README.md
+++ b/README.md
@@ -188,7 +188,7 @@ graph LR
 
 - **Performance at scale** — 40+ database indexes on foreign keys and frequently queried columns, N+1 query elimination (replaced eager-loaded relation counts with `_count` aggregations and `groupBy` batching), and `select` narrowing on all relation includes to avoid fetching unused columns. Performance seeding script generates 10k employees / 200 teams / 50 departments for load testing. Benchmark script measures all major query patterns with warm-up runs and P95 reporting. Full scaling analysis in [`SCALING.md`](SCALING.md) documents known scaling cliffs and recommendations for 100k+ employees. _Why document scaling limits? A production system should be honest about where it breaks — and have a plan for when it gets there._
 
-- **Docker-ready** — `docker compose up` starts PostgreSQL + MongoDB + the app. Migrations run automatically, demo login works out of the box. _One command, zero setup, fully working._
+- **Docker-ready** — `docker compose up` starts PostgreSQL + MongoDB + the app. Migrations run automatically, demo login works out of the box. _One command after generating three secrets into `.env` — the production build fails closed without them, by design._
 
 ---
 
@@ -353,10 +353,14 @@ The **CI auto-fix agent** (optional — requires paid API credits) runs a 6-stag
 ### Docker (recommended)
 
 ```bash
+# One-time: the production build fails closed without these three secrets
+printf 'AUTH_SECRET=%s\nAUDIT_HMAC_SECRET=%s\nTOTP_ENCRYPTION_KEY=%s\n' \
+  "$(openssl rand -base64 32)" "$(openssl rand -base64 32)" "$(openssl rand -base64 32)" >> .env
+
 docker compose up             # starts PostgreSQL + MongoDB + app at localhost:3000
 ```
 
-That's it. Migrations run automatically, demo login works out of the box — no OAuth setup needed. To add Google/GitHub OAuth, create a `.env` file with your credentials (see below).
+That's it. Migrations run automatically, demo login works out of the box — no OAuth setup needed. To add Google/GitHub OAuth, add your credentials to the same `.env` file (see below).
 
 ### Manual setup
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 26399bb..b6b2333 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -43,6 +43,11 @@ services:
       DATABASE_URL: postgresql://postgres:postgres@db:5432/hrmanager
       MONGODB_URL: mongodb://mongo:27017/hrmanager
       AUTH_SECRET: "${AUTH_SECRET:?AUTH_SECRET must be set - generate with: openssl rand -base64 32}"
+      # Both fail closed in the production build this image runs (NODE_ENV=production):
+      # without AUDIT_HMAC_SECRET every audit write throws (entries silently lost —
+      # Mongo IS wired here), and without TOTP_ENCRYPTION_KEY 2FA setup/verify errors.
+      AUDIT_HMAC_SECRET: "${AUDIT_HMAC_SECRET:?AUDIT_HMAC_SECRET must be set - generate with: openssl rand -base64 32}"
+      TOTP_ENCRYPTION_KEY: "${TOTP_ENCRYPTION_KEY:?TOTP_ENCRYPTION_KEY must be set - generate with: openssl rand -base64 32}"
       AUTH_TRUST_HOST: "true"
       AUTH_GOOGLE_ID: ${AUTH_GOOGLE_ID:-}
       AUTH_GOOGLE_SECRET: ${AUTH_GOOGLE_SECRET:-}