diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3d1994..af343f8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@ All notable changes to this project are logged here, newest first. This file sta
 
 ## 2026-09-04
 
+- Fixed: Portainer stack deploy failed with `env file /data/compose/44/.env not found`. Cause: `docker-compose.yml` used `env_file: - .env`, which requires a real file on disk; Portainer's UI-entered environment variables satisfy `${VAR}` substitution in the compose file but do not create that file. Changed `docker-compose.yml` to reference each setting as `${VAR:-default}` under `environment:` instead, which works both for a real local `.env` (auto-loaded by Compose for substitution) and for values entered directly in Portainer. Corrected the wrong explanation of this in `PORTAINER_DEPLOY.md`.
 - Changed: renamed the default branch from `master` to `main`, both locally and in `PORTAINER_DEPLOY.md`'s repository reference. The old name was just `git init`'s local fallback default, not a deliberate choice.
 - Added: `PORTAINER_DEPLOY.md`, a step-by-step guide for deploying this as its own stack in Portainer, pulled straight from the Gitea repo, including how to set environment variables through Portainer's UI since `.env` is not committed.
 - Changed: swapped `ANTHROPIC_API_KEY` from a personal key to a company-owned key.
diff --git a/PORTAINER_DEPLOY.md b/PORTAINER_DEPLOY.md
index f83106a..f13017d 100644
--- a/PORTAINER_DEPLOY.md
+++ b/PORTAINER_DEPLOY.md
@@ -18,7 +18,9 @@ Repo: `https://primegit.primecontrols-dev.com/m.mabrey/sde-meeting-toolkit.git`
 
 ## Step 2: Set environment variables
 
-`.env` is not in the repo on purpose; it holds secrets and is listed in `.gitignore`. Portainer's stack editor has its own **Environment variables** section, below the repository settings. Add each of these as a name and value pair.
+`.env` is not in the repo on purpose; it holds secrets and is listed in `.gitignore`. `docker-compose.yml` reads each setting through `${VARIABLE_NAME}` substitution instead of a literal `env_file`, so it works whether the value comes from a real `.env` next to the file (local and Docker Desktop use) or from Portainer's own stack settings (Git-pull use, where no `.env` file exists).
+
+Portainer's stack editor has its own **Environment variables** section, below the repository settings. Add each of these as a name and value pair.
 
 | Name | Value |
 |---|---|
@@ -32,7 +34,7 @@ Repo: `https://primegit.primecontrols-dev.com/m.mabrey/sde-meeting-toolkit.git`
 | `TOKEN_USAGE_FILE` | `./data/token-usage.json` |
 | `MOCK_AI` | `false` |
 
-Portainer writes these into a real `.env` file inside the stack's own directory on the host when it deploys. `docker-compose.yml` reads that same file (`env_file: - .env`), so nothing else needs to change for this to work.
+Portainer passes these to Compose as substitution values for the `${VARIABLE_NAME}` references in `docker-compose.yml`. No `.env` file needs to exist on the host for this to work.
 
 ## Step 3: Deploy
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 34f5691..7fb7528 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,8 +12,16 @@ services:
     restart: unless-stopped
     ports:
       - "5173:5173"
-    env_file:
-      - .env
+    environment:
+      - MOCK_AI=${MOCK_AI:-false}
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
+      - APP_USERS=${APP_USERS:-}
+      - APP_USERNAME=${APP_USERNAME:-}
+      - APP_PASSWORD=${APP_PASSWORD:-}
+      - RATE_LIMIT_MAX=${RATE_LIMIT_MAX:-20}
+      - RATE_LIMIT_WINDOW_MS=${RATE_LIMIT_WINDOW_MS:-300000}
+      - TOKEN_LIMIT_PER_USER=${TOKEN_LIMIT_PER_USER:-0}
+      - TOKEN_USAGE_FILE=${TOKEN_USAGE_FILE:-./data/token-usage.json}
     volumes:
       # Persists the per-user token quota file across restarts and rebuilds.
       # Without this, everyone's daily usage silently resets on every deploy.