diff --git a/backend/.env.example b/backend/.env.example
index d84e650..111f121 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -2,10 +2,11 @@ SECRET_KEY=<generate with: python3 -c "import secrets; print(secrets.token_urlsa
 SQLITE_PATH=./data/homelab.db
 CORS_ORIGINS=["http://localhost:5173","http://localhost:3000"]
 
-# Auth — set a strong password hash (generate with passlib):
-#   python3 -c "from passlib.context import CryptContext; print(CryptContext(schemes=['bcrypt']).hash('yourpassword'))"
+# Auth — default credentials: admin / admin
+# ⚠️  Change before exposing on a network.
+# Generate a new hash: python3 -c "from passlib.context import CryptContext; print(CryptContext(schemes=['bcrypt']).hash('yourpassword'))"
 AUTH_USERNAME=admin
-AUTH_PASSWORD_HASH=
+AUTH_PASSWORD_HASH=$2b$12$RtMbyw17l4N5UGzeXMNAWuzCaVV.XFBY7ZetWheQhxcBDcxahapkG
 
 # Scanner — JSON array of CIDR ranges to scan
 SCANNER_RANGES=["192.168.1.0/24"]
diff --git a/docker-compose.yml b/docker-compose.yml
index ba9efce..9ef080d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,7 +9,7 @@ services:
       SQLITE_PATH: /app/data/homelab.db
       CORS_ORIGINS: '["http://localhost:3000"]'
       AUTH_USERNAME: ${AUTH_USERNAME:-admin}
-      AUTH_PASSWORD_HASH: ${AUTH_PASSWORD_HASH:?AUTH_PASSWORD_HASH must be set}
+      AUTH_PASSWORD_HASH: ${AUTH_PASSWORD_HASH}
       SCANNER_RANGES: ${SCANNER_RANGES:-["192.168.1.0/24"]}
       STATUS_CHECKER_INTERVAL: ${STATUS_CHECKER_INTERVAL:-60}
     volumes: