diff --git a/.env.example b/.env.example
index 6ca58da..99a3b30 100644
--- a/.env.example
+++ b/.env.example
@@ -17,11 +17,16 @@ OPENPROJECT_HOST__NAME=localhost
 PORT=127.0.0.1:8080
 OPENPROJECT_RAILS__RELATIVE__URL__ROOT=
 IMAP_ENABLED=false
+# Must match the password in DATABASE_URL. The db service uses POSTGRES_PASSWORD only on first DB init (new volume).
+POSTGRES_PASSWORD=p4ssw0rd
 DATABASE_URL=postgres://postgres:p4ssw0rd@db/openproject?pool=20&encoding=unicode&reconnect=true
 RAILS_MIN_THREADS=4
 RAILS_MAX_THREADS=16
-PGDATA="/var/lib/postgresql/data"
-OPDATA="/var/openproject/assets"
+# Compose volume source: use a name like pgdata for a Docker named volume. Do not set this to /var/lib/postgresql/data
+# unless you intend a bind mount; a reused directory may keep an old postgres password and break auth.
+PGDATA=pgdata
+# Same idea for OpenProject attachments/assets (named volume vs host path).
+OPDATA=opdata
 COLLABORATIVE_SERVER_URL=ws://localhost:8080/hocuspocus
 COLLABORATIVE_SERVER_SECRET=secret12345
 POSTGRES_VERSION=17 # Note for existing setups: make sure this is the same version you are using right now, or upgrade your database
diff --git a/docker-compose.yml b/docker-compose.yml
index c6f640a..be6cc37 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -22,7 +22,7 @@ x-op-app: &app
     OPENPROJECT_RAILS__RELATIVE__URL__ROOT: "${OPENPROJECT_RAILS__RELATIVE__URL__ROOT:-}"
     OPENPROJECT_COLLABORATIVE__EDITING__HOCUSPOCUS__URL: "${COLLABORATIVE_SERVER_URL:-wss://${OPENPROJECT_HOST__NAME}/hocuspocus}"
     OPENPROJECT_COLLABORATIVE__EDITING__HOCUSPOCUS__SECRET: "${COLLABORATIVE_SERVER_SECRET:-OVERRIDE_ME_PLEASE}"
-    DATABASE_URL: "${DATABASE_URL:-postgres://postgres:p4ssw0rd@db/openproject?pool=20&encoding=unicode&reconnect=true}"
+    DATABASE_URL: "${DATABASE_URL:-postgres://postgres:${POSTGRES_PASSWORD:-p4ssw0rd}@db/openproject?pool=20&encoding=unicode&reconnect=true}"
     RAILS_MIN_THREADS: ${RAILS_MIN_THREADS:-4}
     RAILS_MAX_THREADS: ${RAILS_MAX_THREADS:-16}
     # set to true to enable the email receiving feature. See ./docker/cron for more options
@@ -62,6 +62,7 @@ services:
       args:
         APP_HOST: web
     image: openproject/proxy
+    pull_policy: build # image is built from ./proxy, not pulled
     <<: *restart_policy
     ports:
       - "${PORT:-8080}:80"