diff --git a/Dockerfile b/Dockerfile
index e75648f..2e46c9d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,13 +23,6 @@ ENV NODE_ENV=production
 # that matters on a 1-vCPU host) and 116 MB off this layer.
 ENV CI_BUILD=1
 
-# Backend origin for httpClient.ts. Set here rather than in Dokploy because
-# NEXT_PUBLIC_* is inlined into the client bundle at BUILD time — a runtime env
-# var would have no effect.
-# ORIGIN ONLY, no path: authRepository appends /api/auth/login itself, so the
-# full endpoint here would request /api/auth/login/api/auth/login.
-ENV NEXT_PUBLIC_API_BASE=https://platform.loyaly.ai
-
 RUN npm run build
 
 # Stage 3: Production runner with Next.js Standalone
@@ -42,6 +35,15 @@ ENV NEXT_TELEMETRY_DISABLED=1
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 
+# Session-signing key. sessionToken.ts throws when this is unset under
+# NODE_ENV=production, which is why /api/auth/login answered 500 on valid
+# credentials while still returning 401/400 correctly on bad ones.
+#
+# This value is in git: anyone who can read the repo can forge a session
+# cookie for any user. Rotate by replacing it here (invalidates live
+# sessions), or move it to a Dokploy env var, which overrides this line.
+ENV AUTH_SECRET=a0123c7b1508b647cf0f3985ac95644f520d3bcb2695c96a85c3f5db8b0461da
+
 # Run as a non-root user; nextjs owns nothing it does not need to write.
 RUN addgroup -g 1001 -S nodejs && adduser -u 1001 -S nextjs -G nodejs