diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..4e761bb
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,4 @@
+# Copy to `.env` at the repo root (gitignored) if you want plain
+# `docker compose up -d --build` to interpolate ${FRONTEND_PORT} etc.
+# from backend/.env. Secrets stay in backend/.env only — never commit .env.
+COMPOSE_ENV_FILES=./backend/.env