diff --git a/.env b/.env
index d379432..974d860 100644
--- a/.env
+++ b/.env
@@ -90,6 +90,13 @@ famapp_MINIO_BUCKET=garden
 famapp_OPENPLANTBOOK_CLIENT_ID=5JdQLab69RhVaF4er7b7D29BCrkf3fo3OEiDsOQa
 famapp_OPENPLANTBOOK_CLIENT_SECRET=kxPTrdQPAVta7sjVuIRf5EGIJ1fKvlMlqRSJpQtFxRftJhg7oeGnXzwH7ls6tluQLFUYVDYRMwISiAuKZGZLvkuJzUwFGCwhZw7UtW8OvcTGy4717WeNUinvuCDSsNXP
 
+# =============================================================
+# MANAGEMENT (homarr)
+# =============================================================
+# Homarr config encryption key (moved out of docker-compose.yml so all
+# secrets live in .env). Generate with: openssl rand -hex 32
+HOMARR_SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f
+
 # =============================================================
 # CLOUDFLARE DNS (for Caddy DNS-01 TLS challenge)
 # =============================================================
diff --git a/docker-compose.yml b/docker-compose.yml
index 9dc572c..38905df 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -623,7 +623,7 @@ services:
     image: ghcr.io/homarr-labs/homarr:latest
     restart: unless-stopped
     environment:
-      - SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f
+      - SECRET_ENCRYPTION_KEY=${HOMARR_SECRET_ENCRYPTION_KEY}
     networks:
       - management
     volumes: