diff --git a/apps/arcane/.env b/apps/arcane/.env
new file mode 100644
index 0000000..d5810ac
--- /dev/null
+++ b/apps/arcane/.env
@@ -0,0 +1,3 @@
+# Generate a secret using the following command:
+# echo "$(openssl rand -base64 64 | tr -d '=/' | tr -d '\n')"
+PUBLIC_SESSION_SECRET=
\ No newline at end of file
diff --git a/apps/arcane/compose.yaml b/apps/arcane/compose.yaml
index ad6ae81..51f4fd7 100644
--- a/apps/arcane/compose.yaml
+++ b/apps/arcane/compose.yaml
@@ -5,6 +5,11 @@ services:
     restart: unless-stopped
     expose:
       - 3000
+    environment:
+      - APP_ENV=production
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - PUBLIC_SESSION_SECRET=${PUBLIC_SESSION_SECRET?}
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.arcane.rule=Host(`${ARCANE_HOSTNAME?}`)"
@@ -15,12 +20,6 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ${DOCKER_DATA_DIR}/arcane:/app/data
-    environment:
-      - APP_ENV=production
-      - PUID=${PUID}
-      - PGID=${PGID}
-      # Session secret - generate with: openssl rand -base64 32
-      - PUBLIC_SESSION_SECRET=
     profiles:
       - arcane
       - all 
\ No newline at end of file