diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index 6d7fa62..b286409 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -91,13 +91,34 @@ ignored whenever the three `POSTGRES_*` values are present.
 
 Generate a strong password with `openssl rand -base64 32`.
 
-> **Portainer note:** for a Git-based stack these go in the stack's
-> **Environment variables** section (Portainer doesn't read a local `.env`).
-> Set `POSTGRES_DB` / `POSTGRES_USER` / `POSTGRES_PASSWORD` / `AUTH_SECRET_KEY` /
-> `BACKUP_ENC_PASSPHRASE` (and `SMTP_PASSWORD`, if you enable email) there.
+> **Portainer note:** for a Git-based stack the stack's **Environment variables**
+> section is not merely an alternative to `.env` — it is the ONLY route, because
+> Portainer does not read a local `.env` at all. Every value the compose file
+> references as `${VAR}` has to be set there or it arrives empty.
+>
+> The full list, and what an empty one costs you:
+>
+> | Variable | Required? | If unset |
+> |---|---|---|
+> | `POSTGRES_DB` / `POSTGRES_USER` / `POSTGRES_PASSWORD` | **yes** | the stack will not start |
+> | `AUTH_SECRET_KEY` | **yes** | compose fails fast; the API refuses to start |
+> | `LDAP_REQUIRED_GROUP` | **effectively yes** | no group gate — **every account in the domain may sign in**. Silent: sign-in works, so nothing looks wrong. |
+> | `BACKUP_ENC_PASSPHRASE` | before real data | dumps are written unencrypted |
+> | `SMTP_PASSWORD` | only with email on | notifications are recorded and never sent |
+> | `MICRON_DB_URL` | optional | the asset picker degrades to manual entry |
+>
+> Paste values raw — it is a form field, not a shell, so no surrounding quotes.
+> Quotes are not stripped and become part of the value: a quoted
+> `LDAP_REQUIRED_GROUP` will not resolve, and a quoted `MICRON_DB_URL` will not
+> parse.
+>
+> **`MICRON_DB_URL` must be URL-encoded** (`@` → `%40`, `#` → `%23`, `/` → `%2F`)
+> because it is a full connection URL. `LDAP_REQUIRED_GROUP` must NOT be encoded —
+> it is an LDAP distinguished name, and its spaces and commas are legal as they are.
 
-These are the only credentials in the system, and they never appear in the
-compose file or in git.
+`POSTGRES_PASSWORD`, `AUTH_SECRET_KEY`, `BACKUP_ENC_PASSPHRASE`, `SMTP_PASSWORD` and
+the password inside `MICRON_DB_URL` are the only credentials in the system, and none
+of them appears in the compose file or in git.
 
 ## 3. Point your reverse proxy at the nginx container