diff --git a/docker-compose.yml b/docker-compose.yml
index 8963d43..9466c4e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,7 +28,10 @@ services:
       SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/cannamanage
       SPRING_DATASOURCE_USERNAME: cannamanage
       SPRING_DATASOURCE_PASSWORD: cannamanage_dev
-      CANNAMANAGE_SECURITY_JWT_SECRET: docker-dev-secret-key-minimum-32-characters-long-for-hmac
+      # JwtService base64-decodes this secret (Decoders.BASE64.decode) before using it as the
+      # HMAC-SHA key. It MUST be valid base64 — a plaintext string with hyphens throws
+      # "Illegal base64 character: '-'" at token-signing time (HTTP 500 after a successful login).
+      CANNAMANAGE_SECURITY_JWT_SECRET: hmSULRhmFYcOXDwYxb7bGXp7Bovh+hXgua/VqF44Ts/N+8YELWpWiqQ+aLrymCuM
     depends_on:
       db:
         condition: service_healthy