diff --git a/README.md b/README.md
index ac323bb0..b0649862 100644
--- a/README.md
+++ b/README.md
@@ -189,9 +189,12 @@ docker compose exec backend python manage.py manage_rls --status
 
 The default env vars live in `.env.docker` (committed). To override locally without touching git:
 
-1. Copy `.env.docker` to `.env.docker.local`
-2. Edit values as needed
-3. Update `env_file` in `docker-compose.yml` to point to `.env.docker.local`
+1. Copy `.env.docker` to `.env.docker.local` (gitignored)
+2. Edit values as needed — set your own `SECRET_KEY` here, not in `.env.docker`
+3. Rebuild/restart: `docker compose up --build`
+
+Every service loads `.env.docker` first and then `.env.docker.local` if it exists, so
+your overrides win. No edits to `docker-compose.yml` are needed.
 
 ## Project Structure
 
diff --git a/docker-compose.yml b/docker-compose.yml
index cc6853a1..1ccc12e6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,11 @@
 services:
   db:
     image: postgres:16-alpine
-    env_file: .env.docker
+    env_file:
+      - .env.docker
+      # Optional local overrides (gitignored); values here win over .env.docker.
+      - path: .env.docker.local
+        required: false
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./docker/postgres/init-rls-user.sql:/docker-entrypoint-initdb.d/init-rls-user.sql:ro
@@ -27,7 +31,11 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    env_file: .env.docker
+    env_file:
+      - .env.docker
+      # Optional local overrides (gitignored); values here win over .env.docker.
+      - path: .env.docker.local
+        required: false
     volumes:
       - ./backend:/app
       - ./docker/backend/entrypoint.sh:/entrypoint.sh:ro
@@ -44,7 +52,11 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    env_file: .env.docker
+    env_file:
+      - .env.docker
+      # Optional local overrides (gitignored); values here win over .env.docker.
+      - path: .env.docker.local
+        required: false
     volumes:
       - ./backend:/app
     depends_on:
@@ -58,7 +70,11 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    env_file: .env.docker
+    env_file:
+      - .env.docker
+      # Optional local overrides (gitignored); values here win over .env.docker.
+      - path: .env.docker.local
+        required: false
     volumes:
       - ./backend:/app
     depends_on:
@@ -72,7 +88,11 @@ services:
     build:
       context: ./frontend
       dockerfile: Dockerfile
-    env_file: .env.docker
+    env_file:
+      - .env.docker
+      # Optional local overrides (gitignored); values here win over .env.docker.
+      - path: .env.docker.local
+        required: false
     volumes:
       - ./frontend:/app
       - frontend_node_modules:/app/node_modules