diff --git a/stacks/dev/docker-compose.yml b/stacks/dev/docker-compose.yml
index ecb76aa..4932d4d 100644
--- a/stacks/dev/docker-compose.yml
+++ b/stacks/dev/docker-compose.yml
@@ -20,7 +20,7 @@ services:
     environment:
       - PUID=1000
       - PGID=1000
-      - TZ=${TZ}
+      - TZ
       - DEFAULT_WORKSPACE=/workspace
       # Authentik forward_auth at the edge — local password auth disabled via config mount.
     volumes:
@@ -52,13 +52,13 @@ services:
     environment:
       - PUID=1000
       - PGID=1000
-      - TZ=${TZ}
+      - TZ
       - APP_URL=https://docs.ginnoir.com
-      - APP_KEY=${BOOKSTACK_APP_KEY}
+      - APP_KEY
       - DB_HOST=mariadb_bookstack
       - DB_PORT=3306
       - DB_USER=bookstack
-      - DB_PASS=${BOOKSTACK_DB_PASSWORD}
+      - DB_PASS
       - DB_DATABASE=bookstack
       - AUTH_METHOD=oidc
       - AUTH_AUTO_INITIATE=false
@@ -86,11 +86,11 @@ services:
     environment:
       - PUID=1000
       - PGID=1000
-      - TZ=${TZ}
-      - MYSQL_ROOT_PASSWORD=${BOOKSTACK_DB_ROOT_PASSWORD}
+      - TZ
+      - MYSQL_ROOT_PASSWORD
       - MYSQL_DATABASE=bookstack
       - MYSQL_USER=bookstack
-      - MYSQL_PASSWORD=${BOOKSTACK_DB_PASSWORD}
+      - MYSQL_PASSWORD
     volumes:
       - /config/bookstack-db:/config
     healthcheck:
@@ -138,15 +138,15 @@ services:
     env_file:
       - stack.env
     environment:
-      - SECRET_KEY=${PLANE_SECRET_KEY}
+      - SECRET_KEY
       - DEBUG=0
-      - DATABASE_URL=postgresql://plane:${PLANE_DB_PASSWORD}@postgres_plane:5432/plane
+      - DATABASE_URL
       - REDIS_URL=redis://redis_plane:6379/
       - CELERY_BROKER_URL=redis://redis_plane:6379/0
       - USE_MINIO=1
       - AWS_REGION=us-east-1
-      - AWS_ACCESS_KEY_ID=${PLANE_MINIO_USER}
-      - AWS_SECRET_ACCESS_KEY=${PLANE_MINIO_PASSWORD}
+      - AWS_ACCESS_KEY_ID
+      - AWS_SECRET_ACCESS_KEY
       - AWS_S3_ENDPOINT_URL=http://plane_minio:9000
       - AWS_S3_BUCKET_NAME=uploads
       - WEB_URL=https://plane.ginnoir.com
@@ -169,15 +169,15 @@ services:
     env_file:
       - stack.env
     environment:
-      - SECRET_KEY=${PLANE_SECRET_KEY}
+      - SECRET_KEY
       - DEBUG=0
-      - DATABASE_URL=postgresql://plane:${PLANE_DB_PASSWORD}@postgres_plane:5432/plane
+      - DATABASE_URL
       - REDIS_URL=redis://redis_plane:6379/
       - CELERY_BROKER_URL=redis://redis_plane:6379/0
       - USE_MINIO=1
       - AWS_REGION=us-east-1
-      - AWS_ACCESS_KEY_ID=${PLANE_MINIO_USER}
-      - AWS_SECRET_ACCESS_KEY=${PLANE_MINIO_PASSWORD}
+      - AWS_ACCESS_KEY_ID
+      - AWS_SECRET_ACCESS_KEY
       - AWS_S3_ENDPOINT_URL=http://plane_minio:9000
       - AWS_S3_BUCKET_NAME=uploads
     depends_on:
@@ -197,9 +197,9 @@ services:
     env_file:
       - stack.env
     environment:
-      - SECRET_KEY=${PLANE_SECRET_KEY}
+      - SECRET_KEY
       - DEBUG=0
-      - DATABASE_URL=postgresql://plane:${PLANE_DB_PASSWORD}@postgres_plane:5432/plane
+      - DATABASE_URL
       - REDIS_URL=redis://redis_plane:6379/
       - CELERY_BROKER_URL=redis://redis_plane:6379/0
     depends_on:
@@ -219,8 +219,8 @@ services:
     env_file:
       - stack.env
     environment:
-      - SECRET_KEY=${PLANE_SECRET_KEY}
-      - DATABASE_URL=postgresql://plane:${PLANE_DB_PASSWORD}@postgres_plane:5432/plane
+      - SECRET_KEY
+      - DATABASE_URL
       - REDIS_URL=redis://redis_plane:6379/
     depends_on:
       postgres_plane:
@@ -245,8 +245,8 @@ services:
     env_file:
       - stack.env
     environment:
-      - MINIO_USER=${PLANE_MINIO_USER}
-      - MINIO_PASSWORD=${PLANE_MINIO_PASSWORD}
+      - MINIO_USER
+      - MINIO_PASSWORD
 
   postgres_plane:
     container_name: postgres_plane
@@ -258,9 +258,9 @@ services:
     env_file:
       - stack.env
     environment:
-      POSTGRES_USER: plane
-      POSTGRES_PASSWORD: ${PLANE_DB_PASSWORD}
-      POSTGRES_DB: plane
+      - POSTGRES_USER=plane
+      - POSTGRES_PASSWORD
+      - POSTGRES_DB=plane
     volumes:
       - /config/plane/postgres:/var/lib/postgresql/data
     healthcheck:
@@ -296,8 +296,8 @@ services:
     env_file:
       - stack.env
     environment:
-      MINIO_ROOT_USER: ${PLANE_MINIO_USER}
-      MINIO_ROOT_PASSWORD: ${PLANE_MINIO_PASSWORD}
+      - MINIO_ROOT_USER
+      - MINIO_ROOT_PASSWORD
     volumes:
       - /storage1/labdata/plane/minio:/data
     healthcheck:
diff --git a/stacks/dev/stack.env b/stacks/dev/stack.env
index 0c28fb0..bf6a821 100644
--- a/stacks/dev/stack.env
+++ b/stacks/dev/stack.env
@@ -7,17 +7,29 @@ CODE_SERVER_PASSWORD=c0de_s3rver_pass
 # BookStack wiki
 # APP_KEY encrypts session data — DO NOT rotate without invalidating sessions.
 BOOKSTACK_APP_KEY=base64:cSR6L4TPEbM2IFi9MyZcnmexvzAlIHAjn/qMzQKO/t4=
+APP_KEY=base64:cSR6L4TPEbM2IFi9MyZcnmexvzAlIHAjn/qMzQKO/t4=
 BOOKSTACK_DB_PASSWORD=bookstack_d3v_pass
+DB_PASS=bookstack_d3v_pass
 BOOKSTACK_DB_ROOT_PASSWORD=bookstack_r00t_pass
+MYSQL_ROOT_PASSWORD=bookstack_r00t_pass
+MYSQL_PASSWORD=bookstack_d3v_pass
 BOOKSTACK_OIDC_CLIENT_ID=8YV4BI2JVIG1QzS2DbylEgqv56sgfiOVRXOgw2Z5
 BOOKSTACK_OIDC_CLIENT_SECRET=wIyiw7LmGBORDyTdc2crSZryXJHzIq4gtajAKSpOU7e8BkBSO6SstM9gGPrnp4tbJhCFSQggYAgtYd5LOjUvQpSWInzm0JLlmLg1BTlPq5EVVieNYuWRCCQrerj8gRZ0
-# BookStack reads OIDC_* directly (env_file); BOOKSTACK_* kept for Portainer UI mirror if using ${} in compose.
 OIDC_CLIENT_ID=8YV4BI2JVIG1QzS2DbylEgqv56sgfiOVRXOgw2Z5
 OIDC_CLIENT_SECRET=wIyiw7LmGBORDyTdc2crSZryXJHzIq4gtajAKSpOU7e8BkBSO6SstM9gGPrnp4tbJhCFSQggYAgtYd5LOjUvQpSWInzm0JLlmLg1BTlPq5EVVieNYuWRCCQrerj8gRZ0
 
 # Plane project management
 # Rotate with: openssl rand -hex 32
 PLANE_SECRET_KEY=60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b52
+SECRET_KEY=60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b52
 PLANE_DB_PASSWORD=plane_d3v_p4ss_8x3m
+POSTGRES_PASSWORD=plane_d3v_p4ss_8x3m
+DATABASE_URL=postgresql://plane:plane_d3v_p4ss_8x3m@postgres_plane:5432/plane
 PLANE_MINIO_USER=planeadmin
+MINIO_USER=planeadmin
+AWS_ACCESS_KEY_ID=planeadmin
 PLANE_MINIO_PASSWORD=plane_minio_p4ss
+MINIO_PASSWORD=plane_minio_p4ss
+AWS_SECRET_ACCESS_KEY=plane_minio_p4ss
+MINIO_ROOT_USER=planeadmin
+MINIO_ROOT_PASSWORD=plane_minio_p4ss
diff --git a/stacks/resume/docker-compose.yml b/stacks/resume/docker-compose.yml
index 9c9d17f..8352856 100644
--- a/stacks/resume/docker-compose.yml
+++ b/stacks/resume/docker-compose.yml
@@ -45,8 +45,8 @@ services:
     environment:
       - MINIO_BROWSER_REDIRECT_URL=https://minio.ginnoir.com
       - MINIO_IDENTITY_OPENID_CONFIG_URL=https://auth.ginnoir.com/application/o/minio/.well-known/openid-configuration
-      - MINIO_IDENTITY_OPENID_CLIENT_ID=${MINIO_OIDC_CLIENT_ID}
-      - MINIO_IDENTITY_OPENID_CLIENT_SECRET=${MINIO_OIDC_CLIENT_SECRET}
+      - MINIO_IDENTITY_OPENID_CLIENT_ID
+      - MINIO_IDENTITY_OPENID_CLIENT_SECRET
       - MINIO_IDENTITY_OPENID_SCOPES=openid,profile,email
     healthcheck:
       test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
diff --git a/stacks/resume/stack.env b/stacks/resume/stack.env
index 2d11aae..fa9e9d2 100644
--- a/stacks/resume/stack.env
+++ b/stacks/resume/stack.env
@@ -10,7 +10,9 @@ POSTGRES_PASSWORD=postgres
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=minioadmin
 MINIO_OIDC_CLIENT_ID=1jC2ChsCjdh7srOKtr9Jzv1l2RF8omrzshEpAESa
+MINIO_IDENTITY_OPENID_CLIENT_ID=1jC2ChsCjdh7srOKtr9Jzv1l2RF8omrzshEpAESa
 MINIO_OIDC_CLIENT_SECRET=66KML3RcsdcStPO6FIe04cCRyLTztfUDdHcpkIVImUO6WTTHkAFtao4GfZYu9yq4NvFGWxztTv7M8uGZBi4xaVUtJr3K3GU47pLaaWwF1WMsidsRTy760QUJxsUq3i9C
+MINIO_IDENTITY_OPENID_CLIENT_SECRET=66KML3RcsdcStPO6FIe04cCRyLTztfUDdHcpkIVImUO6WTTHkAFtao4GfZYu9yq4NvFGWxztTv7M8uGZBi4xaVUtJr3K3GU47pLaaWwF1WMsidsRTy760QUJxsUq3i9C
 
 # browserless chrome auth token (chrome reads TOKEN, the app reads PRINTER_TOKEN)
 TOKEN=chrome_token