diff --git a/docker-compose.example.yml b/docker-compose.example.yml
index 92bae0c..6805406 100644
--- a/docker-compose.example.yml
+++ b/docker-compose.example.yml
@@ -10,7 +10,9 @@ services:
     restart: unless-stopped
     environment:
       # Read-only Postgres user (see db/setup.sql).
-      DATABASE_URL: "postgres://heatmap_ro:CHANGE_ME@gitea-db:5432/gitea?sslmode=disable"
+      # Pass DATABASE_URL from the host environment — never write credentials to disk.
+      # e.g. export DATABASE_URL=postgres://heatmap_ro:...@gitea-db:5432/gitea?sslmode=disable
+      DATABASE_URL:
       # Comma-separated lowercase usernames whose heatmap may be served.
       ALLOWED_USERS: "didericis"
       # CORS: must match the origin Gitea is served from.