diff --git a/.env.example b/.env.example
index 927641d..fdcc5a0 100644
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,7 @@
 # Used by docker-compose.yml to provision the local Postgres container.
-POSTGRES_USER=batchcooking
-POSTGRES_PASSWORD=batchcooking
+# Pick your own values — do not reuse these across environments, and never
+# commit the real .env (it's git-ignored).
+POSTGRES_USER=changeme
+POSTGRES_PASSWORD=changeme
 POSTGRES_DB=batchcooking
 POSTGRES_PORT=5432
diff --git a/README.md b/README.md
index 0d8c82f..a35ed9f 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,12 @@ cp .env.example .env
 cp apps/api/.env.example apps/api/.env
 ```
 
+Puis **édite ces deux `.env`** pour renseigner de vrais `POSTGRES_USER`/`POSTGRES_PASSWORD`
+(et la `DATABASE_URL` correspondante dans `apps/api/.env`) : les fichiers `.env.example`
+ne contiennent volontairement aucun identifiant réel (juste `changeme`), et
+`docker-compose.yml` refuse de démarrer tant que `POSTGRES_USER`/`PASSWORD`/`DB` ne
+sont pas définis dans `.env` — pas de valeur par défaut en dur dans les fichiers commités.
+
 ### Cypress : téléchargement du binaire
 
 `pnpm install` installe le package `cypress` mais **pas forcément son binaire** (le
diff --git a/apps/api/.env.example b/apps/api/.env.example
index 9f8347e..1cb9717 100644
--- a/apps/api/.env.example
+++ b/apps/api/.env.example
@@ -1,3 +1,5 @@
 NODE_ENV=development
 PORT=3000
-DATABASE_URL="postgresql://batchcooking:batchcooking@localhost:5432/batchcooking?schema=public"
+# Match whatever you set in the root .env (POSTGRES_USER/PASSWORD/DB) —
+# do not commit the real value.
+DATABASE_URL="postgresql://changeme:changeme@localhost:5432/batchcooking?schema=public"
diff --git a/docker-compose.yml b/docker-compose.yml
index 2d75301..e6ea603 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,15 +3,18 @@ services:
     image: postgres:16-alpine
     restart: unless-stopped
     environment:
-      POSTGRES_USER: ${POSTGRES_USER:-batchcooking}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-batchcooking}
-      POSTGRES_DB: ${POSTGRES_DB:-batchcooking}
+      # No defaults on purpose: POSTGRES_USER/PASSWORD/DB must be set in your
+      # local, git-ignored .env (see .env.example). Compose fails loudly if
+      # they're missing instead of falling back to a guessable credential.
+      POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env}
     ports:
       - "${POSTGRES_PORT:-5432}:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-batchcooking}"]
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
       interval: 5s
       timeout: 5s
       retries: 5