diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 0c21919..e56cc00 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -46,6 +46,8 @@ jobs:
             echo "🔄 Updating Containers..."
             # Sync compose file จาก repo → app directory
             cp /share/np-dms/app/source/lcbp3/specs/04-Infrastructure-OPS/04-00-docker-compose/docker-compose-app.yml /share/np-dms/app/docker-compose-app.yml
+            # ⚠️ .env ต้องมีค่าจริงอยู่บน QNAP แล้ว (ไม่ sync จาก repo เพราะ repo มีแค่ template)
+            # ถ้ายังไม่มี: cp .env.example .env แล้วตั้งค่าจริง
             cd /share/np-dms/app
             # ⚠️ ลบ container เดิมที่อาจสร้างจาก Container Station
             docker rm -f backend frontend 2>/dev/null || true
diff --git a/specs/04-Infrastructure-OPS/04-00-docker-compose/docker-compose-app.yml b/specs/04-Infrastructure-OPS/04-00-docker-compose/docker-compose-app.yml
index 2c35275..86009ad 100644
--- a/specs/04-Infrastructure-OPS/04-00-docker-compose/docker-compose-app.yml
+++ b/specs/04-Infrastructure-OPS/04-00-docker-compose/docker-compose-app.yml
@@ -56,18 +56,18 @@ services:
       DB_PORT: '3306'
       DB_DATABASE: 'lcbp3'
       DB_USERNAME: 'center'
-      DB_PASSWORD: '<SET_IN_CONTAINER_STATION>'
+      DB_PASSWORD: '${DB_PASSWORD}'
       # --- Redis ---
       REDIS_HOST: 'cache'
       REDIS_PORT: '6379'
-      REDIS_PASSWORD: '<SET_IN_CONTAINER_STATION>'
+      REDIS_PASSWORD: '${REDIS_PASSWORD}'
       # --- Elasticsearch ---
       ELASTICSEARCH_HOST: 'search'
       ELASTICSEARCH_PORT: '9200'
       # --- JWT ---
-      JWT_SECRET: '<SET_IN_CONTAINER_STATION>'
+      JWT_SECRET: '${JWT_SECRET}'
       JWT_EXPIRATION: '8h'
-      JWT_REFRESH_SECRET: '<SET_IN_CONTAINER_STATION>'
+      JWT_REFRESH_SECRET: '${JWT_REFRESH_SECRET}'
       # --- Numbering ---
       NUMBERING_LOCK_TIMEOUT: '5000'
       NUMBERING_RESERVATION_TTL: '300'
@@ -113,7 +113,7 @@ services:
       HOSTNAME: '0.0.0.0'
       PORT: '3000'
       # --- NextAuth ---
-      AUTH_SECRET: '<SET_IN_CONTAINER_STATION>'
+      AUTH_SECRET: '${AUTH_SECRET}'
       AUTH_URL: 'https://lcbp3.np-dms.work'
     networks:
       - lcbp3