diff --git a/.env.example b/.env.example
index d13466e..865b117 100644
--- a/.env.example
+++ b/.env.example
@@ -9,7 +9,7 @@ TZ=UTC
 # Flask secret key (auto-generated if not set)
 # INTERCEPT_SECRET_KEY=your-secret-key-here
 
-# Admin credentials (password auto-generated on first run if not set)
+# Admin credentials (default: admin/admin if not set — change before exposing on a network)
 # INTERCEPT_ADMIN_USERNAME=admin
 # INTERCEPT_ADMIN_PASSWORD=your-password-here
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 01d3133..4ff7aeb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -106,7 +106,7 @@ services:
       - INTERCEPT_ADSB_DB_PORT=5432
       - INTERCEPT_ADSB_DB_NAME=intercept_adsb
       - INTERCEPT_ADSB_DB_USER=intercept
-      - INTERCEPT_ADSB_DB_PASSWORD=intercept
+      - INTERCEPT_ADSB_DB_PASSWORD=${INTERCEPT_ADSB_DB_PASSWORD:-intercept}
       # ADS-B auto-start on dashboard load (default false)
       - INTERCEPT_ADSB_AUTO_START=${INTERCEPT_ADSB_AUTO_START:-false}
       # Shared observer location across modules
@@ -133,7 +133,7 @@ services:
       - TZ=${TZ:-UTC}
       - POSTGRES_DB=intercept_adsb
       - POSTGRES_USER=intercept
-      - POSTGRES_PASSWORD=intercept
+      - POSTGRES_PASSWORD=${INTERCEPT_ADSB_DB_PASSWORD:-intercept}
     volumes:
       # Default local path (override with PGDATA_PATH for external storage)
       - ${PGDATA_PATH:-./pgdata}:/var/lib/postgresql/data
diff --git a/setup.sh b/setup.sh
index cf28799..3d4db49 100755
--- a/setup.sh
+++ b/setup.sh
@@ -2111,7 +2111,7 @@ do_health_check() {
     db_name=$(read_env_var INTERCEPT_ADSB_DB_NAME "intercept_adsb")
     db_user=$(read_env_var INTERCEPT_ADSB_DB_USER "intercept")
     if cmd_exists psql; then
-      if PGPASSWORD="$(read_env_var INTERCEPT_ADSB_DB_PASS)" psql -h "$db_host" -p "$db_port" -U "$db_user" -d "$db_name" -c "SELECT 1" >/dev/null 2>&1; then
+      if PGPASSWORD="$(read_env_var INTERCEPT_ADSB_DB_PASSWORD)" psql -h "$db_host" -p "$db_port" -U "$db_user" -d "$db_name" -c "SELECT 1" >/dev/null 2>&1; then
         ok "PostgreSQL connection — OK"
         ((pass++)) || true
       else
@@ -2323,7 +2323,7 @@ SQL
   write_env_var "INTERCEPT_ADSB_DB_PORT" "$db_port"
   write_env_var "INTERCEPT_ADSB_DB_NAME" "$db_name"
   write_env_var "INTERCEPT_ADSB_DB_USER" "$db_user"
-  write_env_var "INTERCEPT_ADSB_DB_PASS" "$db_pass"
+  write_env_var "INTERCEPT_ADSB_DB_PASSWORD" "$db_pass"
   ok ".env updated with ADS-B database settings"
 
   # Test connection
@@ -2394,7 +2394,7 @@ do_env_config() {
          "INTERCEPT_ADSB_DB_PORT|Database port|5432" \
          "INTERCEPT_ADSB_DB_NAME|Database name|intercept_adsb" \
          "INTERCEPT_ADSB_DB_USER|Database user|intercept" \
-         "INTERCEPT_ADSB_DB_PASS|Database password|intercept" ;;
+         "INTERCEPT_ADSB_DB_PASSWORD|Database password|intercept" ;;
     4) env_edit_category "Observer Location" \
          "INTERCEPT_SHARED_OBSERVER_LOCATION|Enable shared location (true/false)|true" \
          "INTERCEPT_DEFAULT_LAT|Default latitude|0.0" \