diff --git a/.gitignore b/.gitignore
index ee8edf9..364c38f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,4 @@ favicon_io.zip
 # Tailwind standalone binary (downloaded via `make tailwind`)
 bin/tailwindcss
 node_modules/
+*.pem
diff --git a/config/production.yaml b/config/production.yaml
index 29cfc27..bb89ff3 100644
--- a/config/production.yaml
+++ b/config/production.yaml
@@ -1,16 +1,14 @@
 logger:
   enable: true
   pretty_backtrace: false
-  level: "{{ get_env(name="LOG_LEVEL", default="info") }}"
-  format: "{{ get_env(name="LOG_FORMAT", default="compact") }}"
+  level: {{ get_env(name="LOG_LEVEL", default="info") | json_encode() }}
+  format: {{ get_env(name="LOG_FORMAT", default="compact") | json_encode() }}
 
 server:
   port: {{ get_env(name="PORT", default="5150") }}
-  binding: "{{ get_env(name="SERVER_BINDING", default="0.0.0.0") }}"
-  host: "{{ get_env(name="APP_HOST") }}"
+  binding: {{ get_env(name="SERVER_BINDING", default="0.0.0.0") | json_encode() }}
+  host: {{ get_env(name="APP_HOST") | json_encode() }}
   middlewares:
-    # gzip/br compression for text responses (HTML, CSS, JS) — Lighthouse
-    # "Document request latency: No compression applied".
     compression:
       enable: true
     static:
@@ -23,21 +21,21 @@ server:
       fallback: "assets/static/404.html"
 
 workers:
-  mode: "{{ get_env(name="WORKER_MODE", default="BackgroundAsync") }}"
+  mode: {{ get_env(name="WORKER_MODE", default="BackgroundAsync") | json_encode() }}
 
 mailer:
   stub: {{ get_env(name="MAILER_STUB", default="true") }}
   smtp:
     enable: {{ get_env(name="SMTP_ENABLE", default="false") }}
-    host: "{{ get_env(name="SMTP_HOST", default="localhost") }}"
+    host: {{ get_env(name="SMTP_HOST", default="localhost") | json_encode() }}
     port: {{ get_env(name="SMTP_PORT", default="1025") }}
     secure: {{ get_env(name="SMTP_SECURE", default="false") }}
     auth:
-      user: "{{ get_env(name="SMTP_USER", default="") }}"
-      password: "{{ get_env(name="SMTP_PASSWORD", default="") }}"
+      user: {{ get_env(name="SMTP_USER", default="") | json_encode() }}
+      password: {{ get_env(name="SMTP_PASSWORD", default="") | json_encode() }}
 
 database:
-  uri: "{{ get_env(name="DATABASE_URL") }}"
+  uri: {{ get_env(name="DATABASE_URL") | json_encode() }}
   enable_logging: {{ get_env(name="DB_ENABLE_LOGGING", default="false") }}
   connect_timeout: {{ get_env(name="DB_CONNECT_TIMEOUT", default="500") }}
   idle_timeout: {{ get_env(name="DB_IDLE_TIMEOUT", default="500") }}
@@ -53,31 +51,29 @@ auth:
       - from: Cookie
         name: auth_token
       - from: Bearer
-    secret: "{{ get_env(name="JWT_SECRET") }}"
+    secret: {{ get_env(name="JWT_SECRET") | json_encode() }}
     expiration: {{ get_env(name="JWT_EXPIRATION", default="604800") }}
 
 settings:
-  admin_email: "{{ get_env(name="ADMIN_EMAIL", default="") }}"
-  uploads_root: "{{ get_env(name="UPLOADS_ROOT", default="data/uploads") }}"
+  admin_email: {{ get_env(name="ADMIN_EMAIL", default="") | json_encode() }}
+  uploads_root: {{ get_env(name="UPLOADS_ROOT", default="data/uploads") | json_encode() }}
 
-# loco-oauth2 social login. All values must come from the environment in prod;
-# OAUTH_REDIRECT_URL / OAUTH_PROTECTED_URL must use the real public origin.
 initializers:
   oauth2:
-    secret_key: "{{ get_env(name="OAUTH_PRIVATE_KEY") }}"
+    secret_key: {{ get_env(name="OAUTH_PRIVATE_KEY") | json_encode() }}
     authorization_code:
       - client_identifier: google
         client_credentials:
-          client_id: "{{ get_env(name="OAUTH_CLIENT_ID") }}"
-          client_secret: "{{ get_env(name="OAUTH_CLIENT_SECRET") }}"
+          client_id: {{ get_env(name="OAUTH_CLIENT_ID") | json_encode() }}
+          client_secret: {{ get_env(name="OAUTH_CLIENT_SECRET") | json_encode() }}
         url_config:
-          auth_url: "{{ get_env(name="OAUTH_AUTH_URL", default="https://accounts.google.com/o/oauth2/auth") }}"
-          token_url: "{{ get_env(name="OAUTH_TOKEN_URL", default="https://www.googleapis.com/oauth2/v3/token") }}"
-          redirect_url: "{{ get_env(name="OAUTH_REDIRECT_URL") }}"
-          profile_url: "{{ get_env(name="OAUTH_PROFILE_URL", default="https://openidconnect.googleapis.com/v1/userinfo") }}"
+          auth_url: {{ get_env(name="OAUTH_AUTH_URL", default="https://accounts.google.com/o/oauth2/auth") | json_encode() }}
+          token_url: {{ get_env(name="OAUTH_TOKEN_URL", default="https://www.googleapis.com/oauth2/v3/token") | json_encode() }}
+          redirect_url: {{ get_env(name="OAUTH_REDIRECT_URL") | json_encode() }}
+          profile_url: {{ get_env(name="OAUTH_PROFILE_URL", default="https://openidconnect.googleapis.com/v1/userinfo") | json_encode() }}
           scopes:
             - "https://www.googleapis.com/auth/userinfo.email"
             - "https://www.googleapis.com/auth/userinfo.profile"
         cookie_config:
-          protected_url: "{{ get_env(name="OAUTH_PROTECTED_URL") }}"
+          protected_url: {{ get_env(name="OAUTH_PROTECTED_URL") | json_encode() }}
         timeout_seconds: 600
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 00107d8..bc43f2a 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -8,7 +8,12 @@ services:
       - .env.production
     environment:
       DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      JWT_SECRET: "${JWT_SECRET:?JWT_SECRET must be set}"
+      OAUTH_CLIENT_SECRET: "${OAUTH_CLIENT_SECRET:?OAUTH_CLIENT_SECRET must be set}"
+      SMTP_PASSWORD: "${SMTP_PASSWORD:?SMTP_PASSWORD must be set}"
+      ADMIN_PASSWORD: "${ADMIN_PASSWORD:?ADMIN_PASSWORD must be set}"
     volumes:
+      - ./config:/usr/app/config:ro
       - kompress_eshop_data:/usr/app/data
     networks:
       - kompress_eshop-net
@@ -22,6 +27,7 @@ services:
       timeout: 5s
       retries: 3
       start_period: 20s
+    command: ["start"]
 
   postgres:
     image: postgres:16-alpine